Modify the subject of an email template - error: Access denied due to XSS

[AJ23494]

Hi Team , 

I am trying to modify the subject of an email template . 

When i do this in the subject line of email template
<% if ((user?.customproperty1).startsWith('RX')) print "Workday Joiner ${user?.firstname} ${user?.lastname} Business Unit : ${user.customproperty1} Hire Date: ${user?.startdate} "%> <% if (!(user?.customproperty1).startsWith('RX')) print "RELX Identity Service: ${user?.customproperty15} AD account created for ${user?.firstname} ${user?.lastname}"%>

It is giving the below error , please suggest .

[This post has been edited by a Moderator to clarify the subject heading.]

[Nikitaj]

Hi @AJ23494 

This is a known issue and because of few variables not exposed in the environment.

Please raise a support ticket as this needs more triaging on logs and variables. 

In the meantime you can check if there are unwanted characters in the email template using below: Managing Email Templates : Customer Portal (freshdesk.com)

[sahajranajee]

Hi @AJ23494 ,

This error is a security check put in place to avoid SQL injection/XSS related attacks. Since your string is using '%> <' , it gets blocked.

You can raise a Saviynt Support ticket to get this added from the backend.

[rushikeshvartak]

Injection seems only checked during update operation. When  you delete existing email template & recreate with same name it work as expected