Use safe md parsing for mail

Ensure backward compatibility by disabling indented code blocks for mail templates
Tweak mail brand colors to match October

modules/backend/formwidgets/MarkdownEditor.php

@@ -22,6 +22,11 @@ class MarkdownEditor extends FormWidgetBase
      */
     public $mode = 'tab';
 
+    /**
+     * @var bool Render preview with safe markdown.
+     */
+    public $safe = false;
+
     //
     // Object properties
     //
@@ -38,6 +43,7 @@ class MarkdownEditor extends FormWidgetBase
     {
         $this->fillFromConfig([
             'mode',
+            'safe',
         ]);
     }
 
@@ -75,11 +81,12 @@ class MarkdownEditor extends FormWidgetBase
     public function onRefresh()
     {
         $value = post($this->getFieldName());
-        $previewHtml = Markdown::parse($value);
+        $previewHtml = $this->safe
+            ? Markdown::parseSafe($value)
+            : Markdown::parse($value);
 
         return [
             'preview' => $previewHtml
         ];
     }
-
 }

modules/system/ServiceProvider.php

@@ -185,6 +185,7 @@ class ServiceProvider extends ModuleServiceProvider
                 'trans'          => ['Lang', 'get'],
                 'transchoice'    => ['Lang', 'choice'],
                 'md'             => ['Markdown', 'parse'],
+                'md_safe'        => ['Markdown', 'parseSafe'],
                 'time_since'     => ['System\Helpers\DateTime', 'timeSince'],
                 'time_tense'     => ['System\Helpers\DateTime', 'timeTense'],
             ]);

modules/system/classes/MailManager.php

@@ -136,7 +136,7 @@ class MailManager
 
         $html = $this->renderTwig($content, $data);
 
-        $html = Markdown::parse($html);
+        $html = Markdown::parseSafe($html);
 
         return $html;
     }

modules/system/models/MailBrandSetting.php

@@ -43,13 +43,13 @@ class MailBrandSetting extends Model
 
     const WHITE_COLOR = '#fff';
     const BODY_BG = '#f5f8fa';
-    const PRIMARY_BG = '#3097d1';
-    const POSITIVE_BG = '#2ab27b';
-    const NEGATIVE_BG = '#bf5329';
+    const PRIMARY_BG = '#3498db';
+    const POSITIVE_BG = '#31ac5f';
+    const NEGATIVE_BG = '#ab2a1c';
     const HEADER_COLOR = '#bbbfc3';
     const HEADING_COLOR = '#2f3133';
     const TEXT_COLOR = '#74787e';
-    const LINK_COLOR = '#3869d4';
+    const LINK_COLOR = '#0181b9';
     const FOOTER_COLOR = '#aeaeae';
     const BORDER_COLOR = '#edeff2';
     const PROMOTION_BORDER_COLOR = '#9ba2ab';

modules/system/models/mailtemplate/fields.yaml

@@ -34,8 +34,8 @@ secondaryTabs:
         content_html:
             type: markdown
             size: giant
-            language: html
             tab: system::lang.mail_templates.content_html
+            safe: true
             stretch: true
 
         content_text:

modules/system/views/mail/layout-default.htm

@@ -16,10 +16,10 @@ name = "Default layout"
 
     <table class="wrapper" width="100%" cellpadding="0" cellspacing="0">
 
-<!-- Header -->
-{% component 'header' %}
-{{ subject }}
-{% endcomponent %}
+        <!-- Header -->
+        {% component 'header' %}
+            {{ subject }}
+        {% endcomponent %}
 
         <tr>
             <td align="center">
@@ -41,10 +41,10 @@ name = "Default layout"
             </td>
         </tr>
 
-<!-- Footer -->
-{% component 'footer' %}
-&copy; 2017 {{ appName }}. All rights reserved.
-{% endcomponent %}
+        <!-- Footer -->
+        {% component 'footer' %}
+            &copy; 2017 {{ appName }}. All rights reserved.
+        {% endcomponent %}
 
     </table>
 

modules/system/views/mail/partial-footer.htm

@@ -8,7 +8,7 @@ name = "Footer"
         <table class="footer" align="center" width="570" cellpadding="0" cellspacing="0">
             <tr>
                 <td class="content-cell" align="center">
-                    {{ body|md }}
+                    {{ body|md_safe }}
                 </td>
             </tr>
         </table>

modules/system/views/mail/partial-panel.htm

@@ -8,7 +8,7 @@ name = "Panel"
             <table width="100%" cellpadding="0" cellspacing="0">
                 <tr>
                     <td class="panel-item">
-                        {{ body|md }}
+                        {{ body|md_safe }}
                     </td>
                 </tr>
             </table>

modules/system/views/mail/partial-promotion.htm

@@ -5,7 +5,7 @@ name = "Promotion"
 <table class="promotion" align="center" width="100%" cellpadding="0" cellspacing="0">
     <tr>
         <td align="center">
-            {{ body|md }}
+            {{ body|md_safe }}
         </td>
     </tr>
 </table>

modules/system/views/mail/partial-subcopy.htm

@@ -1,7 +1,11 @@
+name = "Subcopy"
+==
+{{ body }}
+==
 <table class="subcopy" width="100%" cellpadding="0" cellspacing="0">
     <tr>
         <td>
-            {{ body|md }}
+            {{ body|md_safe }}
         </td>
     </tr>
 </table>

modules/system/views/mail/partial-table.htm

@@ -2,4 +2,6 @@ name = "Table"
 ==
 {{ body }}
 ==
-<div class="table">{{ body|md }}</div>
+<div class="table">
+    {{ body|md_safe }}
+</div>