Remove render string usage

CHANGELOG.md

@@ -1,9 +1,12 @@
 # Release Notes for Campaign
 
-## 1.25.1 - Unreleased
+## 1.25.1 - 2024-03-05
 ### Changed
 - Logs are now output to the Craft log, in addition to the Campaign log file.
 
+### Security
+- Removed the ability to use `contact` and `mailingList` variables in sendout subjects.
+
 ## 1.25.0 - 2023-11-09
 ### Added
 - Added the `sendoutJobPriority` config setting ([#433](https://github.com/putyourlightson/craft-campaign/issues/433)).

src/services/SendoutsService.php

@@ -307,9 +307,6 @@ public function sendTest(SendoutElement $sendout, ContactElement $contact): bool
         // Set the current site from the sendout's site ID
         Craft::$app->sites->setCurrentSite($sendout->siteId);
 
-        // Get subject
-        $subject = Craft::$app->getView()->renderString($sendout->subject, ['contact' => $contact]);
-
         // Get body, catching template rendering errors
         try {
             $htmlBody = $campaign->getHtmlBody($contact, $sendout);
@@ -330,7 +327,7 @@ public function sendTest(SendoutElement $sendout, ContactElement $contact): bool
         $message = Campaign::$plugin->mailer->compose()
             ->setFrom([$sendout->fromEmail => $sendout->fromName])
             ->setTo($contact->email)
-            ->setSubject('[Test] '.$subject)
+            ->setSubject('[Test] '.$sendout->subject)
             ->setHtmlBody($htmlBody)
             ->setTextBody($plaintextBody);
 
@@ -400,12 +397,6 @@ public function sendEmail(SendoutElement $sendout, ContactElement $contact, int
 
         $mailingList = $this->_getMailingList($mailingListId);
 
-        // Get subject
-        $subject = Craft::$app->getView()->renderString($sendout->subject, [
-            'contact' => $contact,
-            'mailingList' => $mailingList,
-        ]);
-
         // Get body, catching template rendering errors
         try {
             $htmlBody = $campaign->getHtmlBody($contact, $sendout, $mailingList);
@@ -440,7 +431,7 @@ public function sendEmail(SendoutElement $sendout, ContactElement $contact, int
         $message = Campaign::$plugin->mailer->compose()
             ->setFrom([$sendout->fromEmail => $sendout->fromName])
             ->setTo($contact->email)
-            ->setSubject($subject)
+            ->setSubject($sendout->subject)
             ->setHtmlBody($htmlBody)
             ->setTextBody($plaintextBody);