Issue Summary

Modifications to the batched email notification templates in Jira 10 will not be reflected because the batched email templates are not in the velocity allowlist

Steps to Reproduce

1. Install Jira 10.3.2
2. Customize batched email notification templates

Expected Results

Modifications are reflected in batched email notifications

Actual Results

Modifications are not reflected and the following error is thrown in atlassian-jira.log:

Caesium-1-4 ERROR ServiceRunner     [c.atlassian.velocity.DefaultVelocityManager] Exception getting message body from Velocity: org.apache.velocity.exception.ResourceNotFoundException: Unable to find resource 'templates/email-batch/html/template.vm'
org.apache.velocity.exception.ResourceNotFoundException: Unable to find resource 'templates/email-batch/html/template.vm'

Workaround

This workaround will re-enable templates uploaded by administrators. Administrators must take care to only provide valid and secure templates.

Add the batched email notification templates to the velocity allowlist located at (JIRA-INSTALL-DIR)/atlassian-jira/WEB-INF/classes/velocity-default.properties:

# starts at line number 1001
templates/email-batch/html/template.vm, \
templates/email-batch/html/footer.vm, \
templates/email-batch/html/hr-bottom.vm, \
templates/email-batch/html/IssueUpdateBatcher-content.vm, \
templates/email-batch/html/IssueUpdateBatcher-header.vm, \
templates/email-batch/html/IssueUpdateBatcher-history.vm, \
templates/email-batch/html/IssueUpdateBatcher-subject.vm, \
templates/email-batch/html/IssueUpdateBatcher.vm, \
templates/email-batch/html/spacer.vm, \
templates/email-batch/html/template.vm, \
templates/email-batch/shared/mention-text.vm, \
templates/email-batch/text/IssueUpdateBatcher-subject.vm, \
templates/email-batch/text/IssueUpdateBatcher.vm