From 33e977b796db617bd1c79e2ca119dcd88c02a40e Mon Sep 17 00:00:00 2001
From: Yuri Kuznetsov <yurikuzn@users.noreply.github.com>
Date: Thu, 17 Oct 2024 17:04:52 +0300
Subject: [PATCH] user check

---
 application/Espo/Tools/Email/Api/PostUsers.php | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/application/Espo/Tools/Email/Api/PostUsers.php b/application/Espo/Tools/Email/Api/PostUsers.php
index fdf62c1de4..8c2eecf553 100644
--- a/application/Espo/Tools/Email/Api/PostUsers.php
+++ b/application/Espo/Tools/Email/Api/PostUsers.php
@@ -140,6 +140,10 @@ class PostUsers implements Action
             if (!$this->acl->checkEntityRead($user)) {
                 throw new Forbidden("No access to user.");
             }
+
+            if (!$user->isRegular() && !$user->isAdmin()) {
+                throw new Forbidden("Only regular and admin users allowed.");
+            }
         }
 
         return $users;