Merge pull request #16552 from jjcoffee/15700

Escape HTML in welcome message
Expensify · Mar 29, 2023 · 608b696 · 608b696
2 parents d8657ba + 26668e5
commit 608b696
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/src/libs/actions/Policy.js b/src/libs/actions/Policy.js
@@ -271,7 +271,9 @@ function addMembersToWorkspace(memberLogins, welcomeNote, policyID) {
 
     API.write('AddMembersToWorkspace', {
         employees: JSON.stringify(_.map(logins, login => ({email: login}))),
-        welcomeNote,
+
+        // Escape HTML special chars to enable them to appear in the invite email
+        welcomeNote: _.escape(welcomeNote),
         policyID,
     }, {optimisticData, successData, failureData});
 }