Add custom additonal email text to all emailsce-4474-custom-additional-text-in-confirmation-email

Fix https://gitlab.com/gitlab-org/gitlab-ee/issues/4474

Conflicts:
	db/schema.rb
	ee/app/controllers/ee/admin/application_settings_controller.rb
	ee/app/helpers/ee/application_settings_helper.rb
	ee/app/models/ee/application_setting.rb
	ee/app/models/license.rb
	ee/app/views/layouts/service_desk.html.haml
	ee/app/views/notify/approved_merge_request_email.html.haml
	ee/app/views/notify/service_desk_new_note_email.text.erb
	ee/app/views/notify/service_desk_thank_you_email.text.erb
	ee/app/views/notify/unapproved_merge_request_email.html.haml
	ee/lib/ee/api/entities.rb
	ee/spec/controllers/admin/application_settings_controller_spec.rb
	ee/spec/models/application_setting_spec.rb
	ee/spec/requests/api/settings_spec.rb
	lib/api/settings.rb
	spec/mailers/previews/notify_preview.rb

2 files changed, 7 insertions, 2 deletions

diff --git a/lib/gitlab/git/hook.rb b/lib/gitlab/git/hook.rb
index 24f027d8da4..7c201c6169b 100644
--- a/lib/gitlab/git/hook.rb
+++ b/lib/gitlab/git/hook.rb
@@ -95,13 +95,13 @@ module Gitlab
         args = [ref, oldrev, newrev]
 
         stdout, stderr, status = Open3.capture3(env, path, *args, options)
-        [status.success?, (stderr.presence || stdout).gsub(/\R/, "<br>").html_safe]
+        [status.success?, Gitlab::Utils.nlbr(stderr.presence || stdout)]
       end
 
       def retrieve_error_message(stderr, stdout)
         err_message = stderr.read
         err_message = err_message.blank? ? stdout.read : err_message
-        err_message.gsub(/\R/, "<br>").html_safe
+        Gitlab::Utils.nlbr(err_message)
       end
     end
   end
diff --git a/lib/gitlab/utils.rb b/lib/gitlab/utils.rb
index dc9391f32cf..b0a492eaa58 100644
--- a/lib/gitlab/utils.rb
+++ b/lib/gitlab/utils.rb
@@ -27,6 +27,11 @@ module Gitlab
         .gsub(/(\A-+|-+\z)/, '')
     end
 
+    # Converts newlines into HTML line break elements
+    def nlbr(str)
+      ActionView::Base.full_sanitizer.sanitize(str, tags: []).gsub(/\r?\n/, '<br>').html_safe
+    end
+
     def remove_line_breaks(str)
       str.gsub(/\r?\n/, '')
     end