From 89b3d28d85c8c4896d7d36223fb0c06b54346c25 Mon Sep 17 00:00:00 2001
From: Daniel Covington <danielc@kentcommunications.com>
Date: Thu, 22 Oct 2026 10:27:02 -0400
Subject: [PATCH] Allow HTTP template links for postcard site

---
 templates/README.md                  | 2 +-
 templates/chiropractor-outreach.html | 5 ++---
 tools/template-common.ps1            | 2 +-
 tools/test-template-flow.ps1         | 5 +++--
 4 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/templates/README.md b/templates/README.md
index bb7db99..7e4c592 100644
--- a/templates/README.md
+++ b/templates/README.md
@@ -2,7 +2,7 @@
 
 Place your source `.html` or `.htm` files here or in subfolders. Importing a file stores a new version in the Access database. Images are copied into that version, so later edits to source files do not change an imported snapshot. Keep private campaign artwork under `templates/local/`, which Git ignores.
 
-The current importer accepts **well-formed HTML written as XML**. Close every tag and quote every attribute, including `<img ... />` and `<br />`. It accepts basic text, links, tables, and constrained inline `style` attributes. It rejects scripts, forms, external stylesheets, event handlers, remote images, SVG, and CSS image URLs. Image paths must be relative to the HTML file's folder and use PNG, JPEG, or GIF.
+The current importer accepts **well-formed HTML written as XML**. Close every tag and quote every attribute, including `<img ... />` and `<br />`. It accepts basic text, HTTP/HTTPS and `mailto:` links, tables, and constrained inline `style` attributes. It rejects scripts, forms, external stylesheets, event handlers, remote images, SVG, and CSS image URLs. Image paths must be relative to the HTML file's folder and use PNG, JPEG, or GIF.
 
 Example:
 
diff --git a/templates/chiropractor-outreach.html b/templates/chiropractor-outreach.html
index 4c4dcd6..e647d85 100644
--- a/templates/chiropractor-outreach.html
+++ b/templates/chiropractor-outreach.html
@@ -8,13 +8,12 @@
         <td style="padding:28px;line-height:1.6;font-size:16px">
           <p style="margin-top:0">Hi, I'm sorry to bug you.</p>
           <p>I'm mailing a big 9x12 postcard to 5,000 homes in Grand Rapids featuring local businesses. I'm looking for a chiropractor to feature. Would that be something you might want to be on?</p>
-          <p>There is a sample ad below:</p>
+          <p>Here is a sample ad:</p>
           <p style="margin-top:0;margin-bottom:8px"><img src="chiropractor_ad.png" alt="Illustrative chiropractic postcard ad with placeholder practice details" width="540" /></p>
-          <p style="margin-top:0;font-size:12px;color:#48677b">Sample layout; practice name and contact details are placeholders.</p>
           <p style="margin-bottom:0">To learn more call, reply, or text<br />
             Daniel Covington<br />
             616-299-7328<br />
-            <a href="https://www.postcardmojo.com" style="color:#176b9b;text-decoration:underline">www.postcardmojo.com</a>
+            <a href="http://www.postcardmojo.com" style="color:#176b9b;text-decoration:underline">www.postcardmojo.com</a>
           </p>
         </td>
       </tr>
diff --git a/tools/template-common.ps1 b/tools/template-common.ps1
index b9ec942..a5d4ae4 100644
--- a/tools/template-common.ps1
+++ b/tools/template-common.ps1
@@ -78,7 +78,7 @@ function Assert-TemplateNode {
         if ($name -eq 'alt' -and $tag -eq 'img') { continue }
         if ($name -eq 'src' -and $tag -eq 'img') { continue }
         if ($name -eq 'href' -and $tag -eq 'a' -and
-            $value -match '^(https://[^\s<>"'']+|mailto:[^\s<>"'']+)$') { continue }
+            $value -match '^(https?://[^\s<>"'']+|mailto:[^\s<>"'']+)$') { continue }
         if ($name -in @('width', 'height', 'border', 'cellpadding', 'cellspacing') -and
             $value -match '^[0-9]{1,4}(%|px)?$') { continue }
         if ($name -eq 'align' -and $value -in @('left', 'center', 'right')) { continue }
diff --git a/tools/test-template-flow.ps1 b/tools/test-template-flow.ps1
index 4d775ef..6b113a9 100644
--- a/tools/test-template-flow.ps1
+++ b/tools/test-template-flow.ps1
@@ -22,7 +22,7 @@ try {
 
     $png = [Convert]::FromBase64String('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+jRZkAAAAASUVORK5CYII=')
     [System.IO.File]::WriteAllBytes($imagePath, $png)
-    $safe = '<html><body><h1 style="color:#112233; font-size:20px">Postcard</h1><p>See our offer.</p><img src="images/logo.png" width="1" height="1" alt="Logo" /><a href="https://example.invalid">Details</a></body></html>'
+    $safe = '<html><body><h1 style="color:#112233; font-size:20px">Postcard</h1><p>See our offer.</p><img src="images/logo.png" width="1" height="1" alt="Logo" /><a href="http://example.invalid">Details</a></body></html>'
     [System.IO.File]::WriteAllText($templatePath, $safe, [System.Text.Encoding]::UTF8)
 
     & $powerShellX86 -NoProfile -ExecutionPolicy Bypass -File (Join-Path $PSScriptRoot 'import-template.ps1') -Path $templatePath -ConfigPath $configPath
@@ -40,7 +40,8 @@ try {
     foreach ($invalid in @(
         $safe.Replace('<p>See our offer.</p>', '<script>alert(1)</script>'),
         $safe.Replace('images/logo.png', '../secret.png'),
-        $safe.Replace('color:#112233', 'background-image:url(file:///C:/secret)')
+        $safe.Replace('color:#112233', 'background-image:url(file:///C:/secret)'),
+        $safe.Replace('http://example.invalid', 'javascript:alert(1)')
     )) {
         [System.IO.File]::WriteAllText($templatePath, $invalid, [System.Text.Encoding]::UTF8)
         $ErrorActionPreference = 'Continue'