diff --git a/lib/Service/NotificationMailer.php b/lib/Service/NotificationMailer.php index e3a8725..a6c17ce 100644 --- a/lib/Service/NotificationMailer.php +++ b/lib/Service/NotificationMailer.php @@ -31,12 +31,6 @@ class NotificationMailer { */ private const FOOTER_LANGUAGE = 'de'; - /** - * Descriptions are unbounded in Deck; keep the mail readable and well - * clear of any MTA size limits. - */ - private const MAX_DESCRIPTION_LENGTH = 2000; - public function __construct( private IMailer $mailer, private IURLGenerator $urlGenerator, @@ -106,7 +100,7 @@ class NotificationMailer { private function addCard(IEMailTemplate $template, Workflow $workflow, Card $card, array $targets): void { // Single-argument addBodyText() runs htmlspecialchars() itself, so // these card-, workflow-, board- and stack-titles (user input) are - // safe as-is — unlike the description below, which passes both parts. + // safe as-is. The card description is deliberately left out. $template->addBodyText(sprintf( 'Die Karte „%1$s“ wurde verschoben, weil sie überfällig ist (Workflow „%2$s“).', $card->getTitle(), @@ -118,7 +112,6 @@ class NotificationMailer { $targets['sourceStack'], $targets['targetStack'], )); - $this->addCardDescription($template, $card); $template->addBodyButton( 'Karte öffnen', $this->urlGenerator->getAbsoluteURL('/apps/deck/board/' . $workflow->getBoardId() . '/card/' . $card->getId()), @@ -184,33 +177,4 @@ class NotificationMailer { ]); } } - - /** - * Appends the card's description, if it has one. - * - * Deck stores the description as Markdown. It is sent as-is rather than - * rendered: pulling a Markdown parser in just for the mail would be a - * lot of machinery, and unrendered Markdown still reads fine. - */ - private function addCardDescription(IEMailTemplate $template, Card $card): void { - $description = trim((string)$card->getDescription()); - if ($description === '') { - return; - } - - if (mb_strlen($description) > self::MAX_DESCRIPTION_LENGTH) { - $description = mb_substr($description, 0, self::MAX_DESCRIPTION_LENGTH) . ' […]'; - } - - $template->addBodyText('Karteninhalt:'); - - // addBodyText() only runs htmlspecialchars() when it has to build the - // plain-text part itself. Passing both parts means escaping is on us - // -- and it has to be, because a card description is user input that - // would otherwise land unescaped in the HTML mail. - $template->addBodyText( - nl2br(htmlspecialchars($description, ENT_QUOTES, 'UTF-8'), false), - $description, - ); - } }