Is it (un)safe to let users edit email Django templates in your app for emails?
It all depends on the context in which the template will be evaluated, just make sure that no variable is passed that should be considered private.
Also, should a security bug be discovered in Django templating system, your web application would be at risk. You would have to validate the input, but you can't really do that, because the input does not have any particular structure.
So try and sandbox the process from the rest of the application, if you can. Or simply ask yourself if this feature is really necessary and if you can't just let the user specify what to include in the message by using a checklist or anything similar. At that point, validating the input becomes trivial and you don't have to expose the full template to the user.
I'm creating an small SaaS app in Django. It gathers data from webservers from different organizations. Once in a while it automatically needs to send out notification mails to their customers (domain owners).
I would like to let our users (the webhosters) to change the email templates to their likings/needs, before sending them out. The email templates are plain Django templates, including a number of available variables. So, i created a model for the email templates. Which can be edited by the users through a form. The have access to a limited number of template variables per email template.
Are there any security issues/risks that I need to be aware of? Or is this approach recommended.
My approach is currently aimed at server side rendering of the emails. I also checked out some solutions for client side rendering, like Dust.js, but I'm not yet convinced that it will help me.