I updated Sprout Email from 4.0.8 to 4.4.9, along with Craft now being at 3.6.15.

Since then the variables inside my (redactor) custom field aren’t replaced anymore. The email template ist basically the example template outputting basic html and: {{ email.emailBodyHtml_de }}.

The content of email.emailBodyHtml_de contains things like {firstName} and {{ siteUrl }}, but they are not replaced with the User Model values (the notification is triggered at user save).

When I add {{ object.firstName }} to the html template, it outputs the name correctly, but the variables coming from the custom field aren’t replaced.

Has something changed that I am missing?

Any hint is much appreciated.

Cheers, Mark


This was a change introduced in v4.2.0 to address a security vulnerability. It was noted in the changelog and upgrade notes.

The Subject and Default Body will still render values dynamically but any personalization needed for custom fields would currently, as you've discovered, need to be handled in the templates.

I do have plans to review this more closely and see if I can find a workaround for custom fields, but for the time being, had to revert to the support above for security considerations.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.