Use Velocity to generate email

I think we only need sanitise user content, ie "htmlMessage", not all our
emails.


On Mon, Jul 14, 2014 at 1:32 PM, Carlos Munoz <notifications@github.com>
wrote:

> In zanata-war/src/main/java/org/zanata/service/impl/EmailServiceImpl.java:
>
> > @@ -50,8 +68,13 @@
> >  @Slf4j
> >  // TODO refactor class to minimise duplicate code
> >  public class EmailServiceImpl implements EmailService {
> > -    @In(create = true)
> > -    private Renderer renderer;
> > +
> > +    // Don't allow CSS styles, scripts, etc
> > +    static final PolicyFactory sanitizer =
> > +            BLOCKS.and(FORMATTING).and(IMAGES).and(LINKS);
>
> If the EmailService is the one holding the sanitizer, I wonder if we also
> need to sanitize all those emails that don't go out via this service.
>
> —
> Reply to this email directly or view it on GitHub
> <https://github.com/zanata/zanata-server/pull/534/files#r14862972>.
>