Get rid of vulnerable preg_replace eval and create_function (#1485686) + correctly handle base and link tags in html messages