From 4fa59bf7607cb1898e7b88d8df7a0915445d4768 Mon Sep 17 00:00:00 2001
From: Yuriy Bakhtin <yurybakh@gmail.com>
Date: Thu, 5 Mar 2026 09:41:49 +0300
Subject: [PATCH] Encode user name

---
 docs/CHANGELOG.md               |  1 +
 models/MessageNotification.php  | 10 +++++-----
 widgets/InboxMessagePreview.php |  4 ++--
 widgets/ParticipantUserList.php |  4 +++-
 4 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 874ae84d..f16e821e 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -5,6 +5,7 @@ Changelog
 -----------------------
 - Enh #68: Make "subject" optional
 - Fix #485: Compatibility with HumHub 1.18.1
+- Fix #487: Encode user name
 
 3.3.8 (January 15, 2026)
 -----------------------
diff --git a/models/MessageNotification.php b/models/MessageNotification.php
index ee341352..cb013f71 100644
--- a/models/MessageNotification.php
+++ b/models/MessageNotification.php
@@ -2,6 +2,7 @@
 
 namespace humhub\modules\mail\models;
 
+use humhub\helpers\Html;
 use humhub\modules\content\widgets\richtext\converter\RichTextToEmailHtmlConverter;
 use humhub\modules\content\widgets\richtext\converter\RichTextToHtmlConverter;
 use humhub\modules\mail\helpers\Url;
@@ -14,7 +15,6 @@
 use humhub\modules\user\models\User;
 use Yii;
 use yii\base\BaseObject;
-use yii\helpers\Html;
 
 class MessageNotification extends BaseObject
 {
@@ -190,7 +190,7 @@ protected function getContent(User $user)
         if ($this->entry->type === AbstractMessageEntry::TYPE_USER_JOINED) {
             return $this->entry->user->is($user)
                 ? Yii::t('MailModule.base', 'You joined the conversation.')
-                : Yii::t('MailModule.base', '{username} joined the conversation.', ['username' => $this->entry->user->displayName]);
+                : Yii::t('MailModule.base', '{username} joined the conversation.', ['username' => Html::encode($this->entry->user->displayName)]);
         }
 
         return RichTextToEmailHtmlConverter::process($this->entry->content, [
@@ -247,14 +247,14 @@ protected function getEntrySender()
 
     protected function getSubject(User $user): string
     {
-        $params = ['{senderName}' => $this->getEntrySender()->displayName];
-
         if ($this->entry->type === AbstractMessageEntry::TYPE_USER_JOINED) {
             return $this->entry->user->is($user)
                 ? Yii::t('MailModule.base', 'You joined the conversation.')
-                : Yii::t('MailModule.base', '{username} joined the conversation.', ['username' => $this->entry->user->displayName]);
+                : Yii::t('MailModule.base', '{username} joined the conversation.', ['username' => Html::encode($this->entry->user->displayName)]);
         }
 
+        $params = ['{senderName}' => Html::encode($this->getEntrySender()->displayName)];
+
         return $this->isNewConversation
             ? Yii::t('MailModule.base', 'New conversation from {senderName}', $params)
             : Yii::t('MailModule.base', 'New message from {senderName}', $params);
diff --git a/widgets/InboxMessagePreview.php b/widgets/InboxMessagePreview.php
index 1fa87c26..d1287342 100644
--- a/widgets/InboxMessagePreview.php
+++ b/widgets/InboxMessagePreview.php
@@ -101,12 +101,12 @@ public function getMessagePreview(): string
             case AbstractMessageEntry::TYPE_USER_JOINED:
                 return $this->isOwnLastEntry()
                     ? Yii::t('MailModule.base', 'You joined the conversation.')
-                    : Yii::t('MailModule.base', '{username} joined the conversation.', ['username' => $this->getUsername()]);
+                    : Yii::t('MailModule.base', '{username} joined the conversation.', ['username' => Html::encode($this->getUsername())]);
 
             case AbstractMessageEntry::TYPE_USER_LEFT:
                 return $this->isOwnLastEntry()
                     ? Yii::t('MailModule.base', 'You left the conversation.')
-                    : Yii::t('MailModule.base', '{username} left the conversation.', ['username' => $this->getUsername()]);
+                    : Yii::t('MailModule.base', '{username} left the conversation.', ['username' => Html::encode($this->getUsername())]);
         }
 
         if ($this->isGroupChat()) {
diff --git a/widgets/ParticipantUserList.php b/widgets/ParticipantUserList.php
index d7a2aac7..2b0f2cda 100644
--- a/widgets/ParticipantUserList.php
+++ b/widgets/ParticipantUserList.php
@@ -33,7 +33,9 @@ public function run()
             return '';
         }
 
-        return Link::asLink($userList)->action('ui.modal.load', Url::toConversationUserList($this->message));
+        return Link::asLink($userList)
+            ->action('ui.modal.load', Url::toConversationUserList($this->message))
+            ->encodeLabel(false);
     }
 
     private function renderUserList(): string