4 files changed, 8 insertions(+), 10 deletions(-)

M api/graph/schema.resolvers.go
M core/routes.go
M templates/email_add_member_invitation_html.html
M templates/email_add_member_invitation_text.txt

@@ 11,7 11,6 @@ import (
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
-	"html/template"
 	"image"
 	"image/jpeg"
 	"image/png"


@@ 874,20 873,19 @@ func (r *mutationResolver) AddMember(ctx context.Context, input *model.MemberInp
 	}
 
 	confURL := links.GetLinksDomainURL(c)
-	q := url.Values{}
-	q.Set("key", conf.Key)
+	confURL.Path = fmt.Sprintf("/member/confirm/%s", conf.Key)
 	if isNewUser {
+		q := url.Values{}
 		q.Set("redirect", "true")
+		confURL.RawQuery = q.Encode()
 	}
-	confURL.Path = "/member/confirm"
-	confURL.RawQuery = q.Encode()
 
 	data := gobwebs.Map{
 		"title":       lt.Translate("Link Taco: Invitation to join organization"),
 		"currentUser": currentUser.Name,
 		"user":        user.Name,
 		"org":         org.Name,
-		"confURL":     template.URL(confURL.String()),
+		"confURL":     confURL.String(),
 	}
 	helper := email.NewHelper(srv.Email, tmap, tmpl)
 	err = helper.Send(

@@ 47,7 47,7 @@ func (s *Service) RegisterRoutes() {
 	s.Group.GET("/popular", s.PopularLinkList).Name = s.RouteName("popular_link_list")
 	s.Group.GET("/popular/rss", s.PopularLinkList).Name = s.RouteName("popular_link_list_rss")
 	s.Group.GET("/lang", SwiftLang).Name = s.RouteName("lang_switch")
-	s.Group.GET("/member/confirm", s.OrgMemberConfirmation).Name = s.RouteName("org_member_confirmation")
+	s.Group.GET("/member/confirm/:key", s.OrgMemberConfirmation).Name = s.RouteName("org_member_confirmation")
 	s.Group.GET("/q/:hash", s.QRRedirect).Name = s.RouteName("qr_redirect")
 	s.Group.GET("/tour", s.FeatureTour).Name = s.RouteName("feature_tour")
 	s.Group.GET("/pricing", s.PricingList).Name = s.RouteName("pricing_list")


@@ 1199,7 1199,7 @@ func (s *Service) OrgMembersDelete(c echo.Context) error {
 
 // OrgMemberConfirmation ...
 func (s *Service) OrgMemberConfirmation(c echo.Context) error {
-	key := c.QueryParam("key")
+	key := c.Param("key")
 	if key == "" {
 		return echo.NotFoundHandler(c)
 	}

@@ 4,6 4,6 @@
 </p>
 <p style="font-family: sans-serif; font-size: 14px; font-weight: normal; margin: 0; margin-bottom: 15px;">
     Please click the link below:
-    <a href="{{.confURL}}" class="btn btn-primary">{{.confURL}}</a>
+    <a href="{{ htmlSafe .confURL }}" class="btn btn-primary">{{ htmlSafe .confURL }}</a>
 </p>
 {{template "email_base_footer" .}}

@@ 2,4 2,4 @@ You have been invited by {{.currentUser}} to join {{.org}} in links.
 
 Please click the link below:
 
-{{.confURL}}
+{{ htmlSafe .confURL }}