From f99cac5d4c95d75b6f85dba129e9f23e36c027ae Mon Sep 17 00:00:00 2001
From: yuri <yurikuzn@users.noreply.github.com>
Date: Tue, 5 Feb 2019 11:20:00 +0200
Subject: [PATCH] serverside email address validation

---
 application/Espo/Services/Email.php | 30 +++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/application/Espo/Services/Email.php b/application/Espo/Services/Email.php
index 016deaf346..1501950147 100644
--- a/application/Espo/Services/Email.php
+++ b/application/Espo/Services/Email.php
@@ -210,6 +210,8 @@ class Email extends Record
 
         $message = null;
 
+        $this->validateEmailAddresses($entity);
+
         try {
             $emailSender->send($entity, $params, $message);
         } catch (\Exception $e) {
@@ -254,6 +256,34 @@ class Email extends Record
         $this->getEntityManager()->saveEntity($entity);
     }
 
+    public function validateEmailAddresses(\Espo\Entities\Email $entity)
+    {
+        $from = $entity->get('from');
+        if ($from) {
+            if (!filter_var($from, \FILTER_VALIDATE_EMAIL)) {
+                throw new Error('From email address is not valid.');
+            }
+        }
+
+        foreach ($entity->getToList() as $address) {
+            if (!filter_var($address, \FILTER_VALIDATE_EMAIL)) {
+                throw new Error('To email address is not valid.');
+            }
+        }
+
+        foreach ($entity->getCcList() as $address) {
+            if (!filter_var($address, \FILTER_VALIDATE_EMAIL)) {
+                throw new Error('CC email address is not valid.');
+            }
+        }
+
+        foreach ($entity->getBccList() as $address) {
+            if (!filter_var($address, \FILTER_VALIDATE_EMAIL)) {
+                throw new Error('BCC email address is not valid.');
+            }
+        }
+    }
+
     protected function getStreamService()
     {
         if (empty($this->streamService)) {