From 75de70143298014be3a1cd64a69be4bf3133a23c Mon Sep 17 00:00:00 2001
From: Ivan Bochkarev <ivanx86@gmail.com>
Date: Tue, 28 Jul 2026 11:44:05 +0600
Subject: [PATCH 1/2] fix(email): escape ampersands in manager order link href

Unescaped & in ms3_email_new_manager.tpl triggered htmlParseEntityRef
warnings when modPHPMailer inlines CSS via DOMDocument::loadHTML.
---
 .../elements/chunks/ms3_email_new_manager.tpl |  2 +-
 .../tests/EmailChunkHrefAmpersandTest.php     | 45 +++++++++++++++++++
 2 files changed, 46 insertions(+), 1 deletion(-)
 create mode 100644 core/components/minishop3/tests/EmailChunkHrefAmpersandTest.php

diff --git a/core/components/minishop3/elements/chunks/ms3_email_new_manager.tpl b/core/components/minishop3/elements/chunks/ms3_email_new_manager.tpl
index 7a543447..5cf69d2d 100644
--- a/core/components/minishop3/elements/chunks/ms3_email_new_manager.tpl
+++ b/core/components/minishop3/elements/chunks/ms3_email_new_manager.tpl
@@ -86,7 +86,7 @@
             <td>
                 <table style="width:95%;margin:auto;">
                     <tr>
-                        <td><a href="{$site_url}{'manager_url'|option}?a=mgr/orders&namespace=minishop3&order={$order.id}" target="_blank" style="{$style.a}">{'ms3_email_link_to_order' | lexicon}</a></td>
+                        <td><a href="{$site_url}{'manager_url'|option}?a=mgr/orders&amp;namespace=minishop3&amp;order={$order.id}" target="_blank" style="{$style.a}">{'ms3_email_link_to_order' | lexicon}</a></td>
                     </tr>
                 </table>
             </td>
diff --git a/core/components/minishop3/tests/EmailChunkHrefAmpersandTest.php b/core/components/minishop3/tests/EmailChunkHrefAmpersandTest.php
new file mode 100644
index 00000000..c5a14182
--- /dev/null
+++ b/core/components/minishop3/tests/EmailChunkHrefAmpersandTest.php
@@ -0,0 +1,45 @@
+<?php
+
+/**
+ * Проверка email-чанков: в href не должно быть неэкранированных & (DOMDocument/htmlParseEntityRef).
+ *
+ * Запуск: php tests/EmailChunkHrefAmpersandTest.php
+ */
+
+declare(strict_types=1);
+
+$fail = static function (string $message): never {
+    fwrite(STDERR, "FAIL: {$message}\n");
+    exit(1);
+};
+
+$chunksDir = __DIR__ . '/../elements/chunks';
+$files = glob($chunksDir . '/ms3_email*.tpl') ?: [];
+
+if ($files === []) {
+    $fail('No ms3_email*.tpl chunks found');
+}
+
+$hrefPattern = '/href\s*=\s*("|\')([^"\']*)\1/i';
+$bareAmpersand = '/&(?!(?:amp|lt|gt|quot|apos|#\d+|#x[0-9a-fA-F]+);)/';
+
+foreach ($files as $file) {
+    $content = file_get_contents($file);
+    if ($content === false) {
+        $fail('Cannot read ' . basename($file));
+    }
+
+    if (!preg_match_all($hrefPattern, $content, $matches, PREG_SET_ORDER)) {
+        continue;
+    }
+
+    foreach ($matches as $match) {
+        $href = $match[2];
+        if (preg_match($bareAmpersand, $href)) {
+            $fail(basename($file) . ': unescaped & in href: ' . $href);
+        }
+    }
+}
+
+fwrite(STDOUT, "OK EmailChunkHrefAmpersandTest (" . count($files) . " chunks)\n");
+exit(0);

From 7c49795486714ce61b6f4ff813985f1bfd9ac46c Mon Sep 17 00:00:00 2001
From: biz87 <biz87@mail.ru>
Date: Wed, 29 Jul 2026 23:19:25 +0500
Subject: [PATCH 2/2] test(email): match quoted href values correctly (catch
 ampersands past Fenom quotes)

---
 .../minishop3/tests/EmailChunkHrefAmpersandTest.php        | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/core/components/minishop3/tests/EmailChunkHrefAmpersandTest.php b/core/components/minishop3/tests/EmailChunkHrefAmpersandTest.php
index c5a14182..d231c743 100644
--- a/core/components/minishop3/tests/EmailChunkHrefAmpersandTest.php
+++ b/core/components/minishop3/tests/EmailChunkHrefAmpersandTest.php
@@ -20,7 +20,10 @@
     $fail('No ms3_email*.tpl chunks found');
 }
 
-$hrefPattern = '/href\s*=\s*("|\')([^"\']*)\1/i';
+// Match double- and single-quoted hrefs separately: a Fenom href="…{'mod'|…}…" contains
+// single quotes inside the double-quoted value, so a shared [^"']* char class would stop early
+// and never see the query-string ampersands.
+$hrefPattern = '/href\s*=\s*(?:"([^"]*)"|\'([^\']*)\')/i';
 $bareAmpersand = '/&(?!(?:amp|lt|gt|quot|apos|#\d+|#x[0-9a-fA-F]+);)/';
 
 foreach ($files as $file) {
@@ -34,7 +37,7 @@
     }
 
     foreach ($matches as $match) {
-        $href = $match[2];
+        $href = ($match[1] ?? '') . ($match[2] ?? '');
         if (preg_match($bareAmpersand, $href)) {
             $fail(basename($file) . ': unescaped & in href: ' . $href);
         }