Encode invitee email in the invitation link (#10842)

langgenius · Nov 19, 2024 · 6f4885d · 6f4885d
1 parent 2dc29cf
commit 6f4885d
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/api/controllers/console/workspace/members.py b/api/controllers/console/workspace/members.py
@@ -1,3 +1,5 @@
+from urllib import parse
+
 from flask_login import current_user
 from flask_restful import Resource, abort, marshal_with, reqparse
 
@@ -57,11 +59,12 @@ def post(self):
                 token = RegisterService.invite_new_member(
                     inviter.current_tenant, invitee_email, interface_language, role=invitee_role, inviter=inviter
                 )
+                encoded_invitee_email = parse.quote(invitee_email)
                 invitation_results.append(
                     {
                         "status": "success",
                         "email": invitee_email,
-                        "url": f"{console_web_url}/activate?email={invitee_email}&token={token}",
+                        "url": f"{console_web_url}/activate?email={encoded_invitee_email}&token={token}",
                     }
                 )
             except AccountAlreadyInTenantError: