some big beautiful update

application/Espo/Tools/Email/Api/PostSendTest.php

@@ -38,8 +38,10 @@ use Espo\Core\Exceptions\BadRequest;
 use Espo\Core\Exceptions\Error;
 use Espo\Core\Exceptions\Forbidden;
 use Espo\Core\Exceptions\NotFound;
+use Espo\Core\Mail\Account\Util\AddressUtil;
 use Espo\Core\Mail\Exceptions\NoSmtp;
 use Espo\Core\Mail\SmtpParams;
+use Espo\Core\Utils\Security\HostCheck;
 use Espo\Entities\Email;
 use Espo\Tools\Email\SendService;
 use Espo\Tools\Email\TestSendData;
@@ -51,7 +53,9 @@ class PostSendTest implements Action
 {
     public function __construct(
         private SendService $sendService,
-        private Acl $acl
+        private Acl $acl,
+        private HostCheck $hostCheck,
+        private AddressUtil $addressUtil,
     ) {}
 
     /**
@@ -109,6 +113,13 @@ class PostSendTest implements Action
                 ->withAuthMechanism($authMechanism);
         }
 
+        if (
+            !$this->addressUtil->isAllowedAddress($smtpParams) &&
+            !$this->hostCheck->isNotInternalHost($server)
+        ) {
+            throw new Forbidden("Not allowed internal host.");
+        }
+
         $data = new TestSendData($emailAddress, $type, $id, $userId);
 
         $this->sendService->sendTestEmail($smtpParams, $data);