fix(email): экранирование & в ссылке на заказ в письме менеджеру

core/components/minishop3/elements/chunks/ms3_email_new_manager.tpl

@@ -86,7 +86,7 @@
             <td>
                 <table style="width:95%;margin:auto;">
                     <tr>
-                        <td><a href="{$site_url}{'manager_url'|option}?a=mgr/orders&namespace=minishop3&order={$order.id}" target="_blank" style="{$style.a}">{'ms3_email_link_to_order' | lexicon}</a></td>
+                        <td><a href="{$site_url}{'manager_url'|option}?a=mgr/orders&amp;namespace=minishop3&amp;order={$order.id}" target="_blank" style="{$style.a}">{'ms3_email_link_to_order' | lexicon}</a></td>
                     </tr>
                 </table>
             </td>

core/components/minishop3/tests/EmailChunkHrefAmpersandTest.php

@@ -0,0 +1,48 @@
+<?php
+
+/**
+ * Проверка email-чанков: в href не должно быть неэкранированных & (DOMDocument/htmlParseEntityRef).
+ *
+ * Запуск: php tests/EmailChunkHrefAmpersandTest.php
+ */
+
+declare(strict_types=1);
+
+$fail = static function (string $message): never {
+    fwrite(STDERR, "FAIL: {$message}\n");
+    exit(1);
+};
+
+$chunksDir = __DIR__ . '/../elements/chunks';
+$files = glob($chunksDir . '/ms3_email*.tpl') ?: [];
+
+if ($files === []) {
+    $fail('No ms3_email*.tpl chunks found');
+}
+
+// Match double- and single-quoted hrefs separately: a Fenom href="…{'mod'|…}…" contains
+// single quotes inside the double-quoted value, so a shared [^"']* char class would stop early
+// and never see the query-string ampersands.
+$hrefPattern = '/href\s*=\s*(?:"([^"]*)"|\'([^\']*)\')/i';
+$bareAmpersand = '/&(?!(?:amp|lt|gt|quot|apos|#\d+|#x[0-9a-fA-F]+);)/';
+
+foreach ($files as $file) {
+    $content = file_get_contents($file);
+    if ($content === false) {
+        $fail('Cannot read ' . basename($file));
+    }
+
+    if (!preg_match_all($hrefPattern, $content, $matches, PREG_SET_ORDER)) {
+        continue;
+    }
+
+    foreach ($matches as $match) {
+        $href = ($match[1] ?? '') . ($match[2] ?? '');
+        if (preg_match($bareAmpersand, $href)) {
+            $fail(basename($file) . ': unescaped & in href: ' . $href);
+        }
+    }
+}
+
+fwrite(STDOUT, "OK EmailChunkHrefAmpersandTest (" . count($files) . " chunks)\n");
+exit(0);