Some big update

application/Espo/Tools/Email/Api/PostImportEml.php

@@ -36,8 +36,11 @@ use Espo\Core\Api\Response;
 use Espo\Core\Api\ResponseComposer;
 use Espo\Core\Exceptions\BadRequest;
 use Espo\Core\Exceptions\Forbidden;
+use Espo\Core\Exceptions\NotFound;
+use Espo\Entities\Attachment;
 use Espo\Entities\Email;
 use Espo\Entities\User;
+use Espo\ORM\EntityManager;
 use Espo\Tools\Email\ImportEmlService;
 
 /**
@@ -49,6 +52,7 @@ class PostImportEml implements Action
         private Acl $acl,
         private User $user,
         private ImportEmlService $service,
+        private EntityManager $entityManager,
     ) {}
 
     public function process(Request $request): Response
@@ -61,11 +65,32 @@ class PostImportEml implements Action
             throw new BadRequest("No 'fileId'.");
         }
 
-        $email = $this->service->import($fileId, $this->user->getId());
+        $attachment = $this->getAttachment($fileId);
+
+        $email = $this->service->import($attachment, $this->user->getId());
 
         return ResponseComposer::json(['id' => $email->getId()]);
     }
 
+    /**
+     * @throws NotFound
+     * @throws Forbidden
+     */
+    private function getAttachment(string $fileId): Attachment
+    {
+        $attachment = $this->entityManager->getRDBRepositoryByClass(Attachment::class)->getById($fileId);
+
+        if (!$attachment) {
+            throw new NotFound("Attachment not found.");
+        }
+
+        if (!$this->acl->checkEntityRead($attachment)) {
+            throw new Forbidden("No access to attachment.");
+        }
+
+        return $attachment;
+    }
+
     /**
      * @throws Forbidden
      */

application/Espo/Tools/Email/Api/PostSendTest.php

@@ -115,7 +115,7 @@ class PostSendTest implements Action
 
         if (
             !$this->addressUtil->isAllowedAddress($smtpParams) &&
-            !$this->hostCheck->isNotInternalHost($server)
+            !$this->hostCheck->isHostAndNotInternal($server)
         ) {
             throw new Forbidden("Not allowed internal host.");
         }

application/Espo/Tools/Email/ImportEmlService.php

@@ -31,7 +31,6 @@ namespace Espo\Tools\Email;
 
 use Espo\Core\Exceptions\Conflict;
 use Espo\Core\Exceptions\Error;
-use Espo\Core\Exceptions\NotFound;
 use Espo\Core\FileStorage\Manager;
 use Espo\Core\Mail\Exceptions\ImapError;
 use Espo\Core\Mail\Importer;
@@ -56,16 +55,13 @@ class ImportEmlService
     /**
      * Import an EML.
      *
-     * @param string $fileId An attachment ID.
      * @param ?string $userId A user ID to relate an email with.
      * @return Email An Email.
-     * @throws NotFound
      * @throws Error
      * @throws Conflict
      */
-    public function import(string $fileId, ?string $userId = null): Email
+    public function import(Attachment $attachment, ?string $userId = null): Email
     {
-        $attachment = $this->getAttachment($fileId);
         $contents = $this->fileStorageManager->getContents($attachment);
 
         try {
@@ -93,20 +89,6 @@ class ImportEmlService
         return $email;
     }
 
-    /**
-     * @throws NotFound
-     */
-    private function getAttachment(string $fileId): Attachment
-    {
-        $attachment = $this->entityManager->getRDBRepositoryByClass(Attachment::class)->getById($fileId);
-
-        if (!$attachment) {
-            throw new NotFound("Attachment not found.");
-        }
-
-        return $attachment;
-    }
-
     /**
      * @throws Conflict
      */