Allow admins to use object variables in custom fields in Notification Emails

[SanboKyo]

After upgrade Craft Pro (2.9.2 to 3.5.15.1), Sprout Email Pro (2.4.7 to 4.4.8), and several others, object variables (in text and redactor fields) will not rendered in notification emails, although it has worked for several years before.

Object variables in the subject line will resolve and be shown in emails, all others are output as text: { myObjectVariable }

I changed the syntax to {{ object.myVariable }}, but it doesn't work with that either!

One interesting thing: When I click on preview in the notification email list, the {{ object.myVariable }} are replaced with the values from the last submitted form (= saved entry), the { myObjectVariable } are not.

Additional info

• Craft version: 3.5.15.1
• Plugins & versions: Sprout Email Pro 4.4.8
• PHP version: 7.3

Front conversations

[BenParizek]

@SanboKyo Unfortunately, we had to suppress that feature due to a security vulnerability. It's mentioned here in the upgrade notes: https://sprout.barrelstrengthdesign.com/docs/email/installing-and-updating-craft-3.html#upgrading-to-email-v4-2-0

As for the preview, that's likely just an oversight as the back end doesn't pose the same risks as the front-end.

I do want to revisit this at some point as I recognize it is useful but haven't come up with a viable workaround yet.

I'll mark this as a feature request to look into again, but for now you will need to confine any dynamic variables in the CP to the Subject or Default Body fields and move any other customization you want into a custom email template.