fix: escape member.name in step_email; add all-voted reminder test

2026-05-08 21:40:00 -07:00
parent 3b28ad0e1c
commit aea47d8365
2 changed files with 31 additions and 1 deletions
@@ -145,7 +145,7 @@ def step_email(run: "WeeklyRun", db: "Session") -> None:
        email_html = (
            f"<h2>This week's meal suggestions</h2>"
            f"{stale_banner}"
-            f"<p>Hi {member.name}, please vote on this week's meals by Fri 17:00 PT:</p>"
+            f"<p>Hi {html.escape(member.name)}, please vote on this week's meals by Fri 17:00 PT:</p>"
            f"<ul>{''.join(item_html_parts)}</ul>"
            f"<p>Silence = approved. Any denial removes that meal.</p>"
        )