<p>This was a change introduced in v4.2.0 to address a security vulnerability. It was noted in the changelog and <a href="https://sprout.barrelstrengthdesign.com/docs/email/installing-and-updating-craft-3.html#upgrading-to-email-v4-2-0" rel="nofollow noreferrer">upgrade notes</a>.</p>
<p>The <code>Subject</code> and <code>Default Body</code> will still render values dynamically but any personalization needed for custom fields would currently, as you've discovered, need to be handled in the templates.</p>
<p>I do have plans to review this more closely and see if I can find a workaround for custom fields, but for the time being, had to revert to the support above for security considerations.</p>

CC BY-SA 4.0
2021-05-27T19:48:01.883Z
Thanks for the clarification! Might be a good idea to clarify the example notification template as well: https://github.com/barrelstrength/craft-sprout-base-email/blob/v1/src/templates/examples/notification/email.twig#L31
Keep up the great work, much appreciated!
medoingthings
CC BY-SA 4.0
2021-05-27T11:31:20.843Z
2021-05-27T11:31:20.843Z
Ben Parizek
<p>I updated Sprout Email from 4.0.8 to 4.4.9, along with Craft now being at 3.6.15.</p>
<p>Since then the variables inside my (redactor) custom field aren’t replaced anymore. The email template ist basically the example template outputting basic html and: <code>{{ email.emailBodyHtml_de }}</code>.</p>
<p>The content of <code>email.emailBodyHtml_de</code> contains things like <code>{firstName}</code> and <code>{{ siteUrl }}</code>, but they are not replaced with the User Model values (the notification is triggered at user save).</p>
<p>When I add <code>{{ object.firstName }}</code> to the html template, it outputs the name correctly, but the variables coming from the custom field aren’t replaced.</p>
<p>Has something changed that I am missing?</p>
<p>Any hint is much appreciated.</p>
<p>Cheers,
Mark</p>

<plugin-sproutemail>
Sprout Email variables in custom fields aren’t replaced after update
# Sprout Email variables in custom fields aren’t replaced after update

(Asked by: username_0 on 2021-05-27)

I updated Sprout Email from 4.0.8 to 4.4.9, along with Craft now being at 3.6.15.

Since then the variables inside my (redactor) custom field aren’t replaced anymore. The email template ist basically the example template outputting basic html and: `{{ email.emailBodyHtml_de }}`.

The content of `email.emailBodyHtml_de` contains things like `{firstName}` and `{{ siteUrl }}`, but they are not replaced with the User Model values (the notification is triggered at user save).

When I add `{{ object.firstName }}` to the html template, it outputs the name correctly, but the variables coming from the custom field aren’t replaced.

Has something changed that I am missing?

Any hint is much appreciated.

Cheers,
Mark

**Tags:** plugin-sproutemail

---

## 1 answers

### Answer by username_1 on 2021-05-27. Score: 1 | Accepted answer

This was a change introduced in v4.2.0 to address a security vulnerability. It was noted in the changelog and [upgrade notes](https://sprout.barrelstrengthdesign.com/docs/email/installing-and-updating-craft-3.html#upgrading-to-email-v4-2-0).

The `Subject` and `Default Body` will still render values dynamically but any personalization needed for custom fields would currently, as you've discovered, need to be handled in the templates.

I do have plans to review this more closely and see if I can find a workaround for custom fields, but for the time being, had to revert to the support above for security considerations.

> **Comments:**
> **username_0**: Thanks for the clarification! Might be a good idea to clarify the example notification template as well: https://github.com/barrelstrength/craft-sprout-base-email/blob/v1/src/templates/examples/notification/email.twig#L31 Keep up the great work, much appreciated!  

---

