Issue #403: Add organization branding customization to unsubscribe page#432
Issue #403: Add organization branding customization to unsubscribe page#432pushkar444 wants to merge 2 commits into
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughThree nullable fields ( ChangesUnsubscribe Page Branding Customization
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@backend/campaigns/views.py`:
- Around line 721-724: The _unsubscribe_page function interpolates parameters
like title, message, and logo_url directly into HTML without escaping them.
Since these values come from DB-configurable organization fields (lines
760-770), this creates a stored XSS vulnerability on the public unsubscribe
page. Import Django's escape function (or mark_safe for trusted content) and
apply it to escape title, message, and logo_url before they are inserted into
the HTML strings on lines 723 and 740. Ensure all user-supplied organization
fields are properly escaped before HTML interpolation.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: d4805950-d18c-4d5d-a97f-bace8f5467fd
📒 Files selected for processing (3)
backend/campaigns/views.pybackend/tenants/migrations/0003_organization_brand_logo_url_and_more.pybackend/tenants/models.py
Pull Request
🔗 Related Issue
Closes #403
📝 Summary of Changes
unsubscribe_titlefield to the Organization model.unsubscribe_messagefield to the Organization model.brand_logo_urlfield to the Organization model.🏷️ Type of Change
🧪 Testing
Steps to test:
unsubscribe_title,unsubscribe_message, andbrand_logo_urlfor an organization.python -m py_compile campaigns/views.pyto confirm there are no syntax errors.📸 Screenshots (if applicable)
N/A
✅ Checklist
Summary by CodeRabbit
Release Notes