code review: is the vuln gone?

src/app/app.py

@@ -11,9 +11,10 @@ def index():
     return render_template('index.html')
     
 
-@app.route("/email-settings/opt-out")
+@app.route("/email-settings/opt-out", methods=["GET"])
 def email_opt_out():
-    email = request.values.get("email")
+    email = request.form.get("email", "user@example.com")
+    # Temporal fix to prevent SSTI. Fix ASAP!!!
     output = Jinja2.from_string('You have opted out ' + email + 
                                 ' from our service.' + 
                                 '<p>Go back to <a href="/">home</a>.</p>').render()