Webmail print preview no longer displays sender/recipient email addresses after update

Issue Type: [BUG]

Summary: Webmail print preview no longer displays sender/recipient email addresses after update; only display names are printed.

Affected Components: Carbonio CE Webmail / Mails UI / Print email feature

Description:
After updating Carbonio CE, printing an email from the webmail opens the print preview window, but the generated print view no longer displays the actual sender and recipient email addresses. It only displays the friendly/display names.

This used to work before the update. The issue is reproducible from the webmail print function.

This is problematic for audit/legal traceability because a printed email no longer proves the actual sender or recipient addresses. For example, the print output shows only values such as:

From: Friendly Name
To: all

instead of showing the full RFC-style addresses, for example:

From: Friendly Name user@example.com
To: all list@example.com

Server OS: Debian 24.04

Carbonio Version: CE 26.3.2

Current Behavior:
When printing an email from Carbonio Webmail, the print preview/PDF displays only participant display names in the From/To fields. The underlying email addresses are missing from the printed output.

Expected Behavior:
The print preview should include the actual email addresses for sender and recipients, ideally in the format:

Display Name email@domain

or should provide an option to include full email addresses in printed emails.

Steps to Reproduce:

1. Log in to Carbonio Webmail.

2. Open any received email where the sender/recipient has both a display name and an email address.

3. Use the webmail print function for that email.

4. Check the opened print preview window or generated PDF.

5. Observe that From/To fields show only display names and do not show the actual email addresses.

Additional Technical Note:
This appears consistent with a frontend print-template escaping/rendering issue. In the current Carbonio Mails UI print conversation code, the participant header appears to render the address inside literal angle brackets:

Name address@example.com

If this string is inserted into an HTML print document without escaping the angle brackets themselves, the browser may parse address@example.com as an HTML tag and not display it. Escaping the brackets as < and > should preserve the email address visually while keeping the XSS hardening intact.

Suggested fix:
Render the participant as:

Display Name <email@domain>

or render the participant fields as text nodes instead of injecting a raw HTML string.

Tagged: @arman @sharif