Is it (un)safe to let users edit email Django templates in your app for emails?
I believe there are many answers on here already regarding this; but to summarize what I've found: It is "safe" to do so, but take care what variables/objects you expose to the user (i.e. include in the context of the template to be rendered).
render_to_string('template_name.txt', {'user': Users}) would be really bad :)
I'm creating an small SaaS app in Django. It gathers data from webservers from different organizations. Once in a while it automatically needs to send out notification mails to their customers (domain owners).
I would like to let our users (the webhosters) to change the email templates to their likings/needs, before sending them out. The email templates are plain Django templates, including a number of available variables. So, i created a model for the email templates. Which can be edited by the users through a form. The have access to a limited number of template variables per email template.
Are there any security issues/risks that I need to be aware of? Or is this approach recommended.
My approach is currently aimed at server side rendering of the emails. I also checked out some solutions for client side rendering, like Dust.js, but I'm not yet convinced that it will help me.