From ea27eaf166b4e26fc64f318b6e3df2bf7c3bbaab Mon Sep 17 00:00:00 2001
From: Julian Lam <julian@nodebb.org>
Date: Fri, 28 Jan 2022 15:02:21 -0500
Subject: [PATCH] feat: no more sending emails to banned users, + feature flag

---
 install/data/defaults.json                    |  1 +
 .../language/en-GB/admin/settings/email.json  |  3 +-
 src/emailer.js                                | 11 ++++-
 src/views/admin/settings/email.tpl            |  7 ++++
 test/emailer.js                               | 40 +++++++++++++++++++
 5 files changed, 60 insertions(+), 2 deletions(-)

diff --git a/install/data/defaults.json b/install/data/defaults.json
index 11c24c2706..2eb0a15bb1 100644
--- a/install/data/defaults.json
+++ b/install/data/defaults.json
@@ -141,6 +141,7 @@
     "sendValidationEmail": 1,
     "includeUnverifiedEmails": 0,
     "emailPrompt": 1,
+    "sendEmailToBanned": 0,
     "requireEmailAddress": 0,
     "inviteExpiration": 7,
     "dailyDigestFreq": "off",
diff --git a/public/language/en-GB/admin/settings/email.json b/public/language/en-GB/admin/settings/email.json
index 17c60daf69..8f5cdf0f95 100644
--- a/public/language/en-GB/admin/settings/email.json
+++ b/public/language/en-GB/admin/settings/email.json
@@ -43,5 +43,6 @@
 	"include-unverified-emails": "Send emails to recipients who have not explicitly confirmed their emails",
 	"include-unverified-warning": "By default, users with emails associated with their account have already been verified, but there are situations where this is not the case (e.g. SSO logins, grandfathered users, etc). <strong>Enable this setting at your own risk</strong> &ndash; sending emails to unverified addresses may be a violation of regional anti-spam laws.",
 	"prompt": "Prompt users to enter or confirm their emails",
-	"prompt-help": "If a user does not have an email set, or their email is not confirmed, a warning will be shown on screen."
+	"prompt-help": "If a user does not have an email set, or their email is not confirmed, a warning will be shown on screen.",
+	"sendEmailToBanned": "Send emails to users even if they have been banned"
 }
diff --git a/src/emailer.js b/src/emailer.js
index 7b63d3cceb..c196658b1f 100644
--- a/src/emailer.js
+++ b/src/emailer.js
@@ -218,7 +218,8 @@ Emailer.send = async (template, uid, params) => {
 		throw Error('[emailer] App not ready!');
 	}
 
-	let userData = await User.getUserFields(uid, ['email', 'username', 'email:confirmed']);
+	let userData = await User.getUserFields(uid, ['email', 'username', 'email:confirmed', 'banned']);
+	userData.banned = true;
 
 	// 'welcome' and 'verify-email' explicitly used passed-in email address
 	if (['welcome', 'verify-email'].includes(template)) {
@@ -226,6 +227,14 @@ Emailer.send = async (template, uid, params) => {
 	}
 
 	({ template, userData, params } = await Plugins.hooks.fire('filter:email.prepare', { template, uid, userData, params }));
+
+	if (!meta.config.sendEmailToBanned && template !== 'banned') {
+		if (userData.banned) {
+			winston.warn(`[emailer/send] User ${userData.username} (uid: ${uid}) is banned; not sending email due to system config.`);
+			return false;
+		}
+	}
+
 	if (!userData || !userData.email) {
 		if (process.env.NODE_ENV === 'development') {
 			winston.warn(`uid : ${uid} has no email, not sending "${template}" email.`);
diff --git a/src/views/admin/settings/email.tpl b/src/views/admin/settings/email.tpl
index e5b3fab134..d4ef6a52a7 100644
--- a/src/views/admin/settings/email.tpl
+++ b/src/views/admin/settings/email.tpl
@@ -51,6 +51,13 @@
 			</div>
 			<p class="help-block">[[admin/settings/email:prompt-help]]</p>
 
+			<div class="checkbox">
+				<label for="sendEmailToBanned" class="mdl-switch mdl-js-switch mdl-js-ripple-effect">
+					<input class="mdl-switch__input" type="checkbox" id="sendEmailToBanned" data-field="sendEmailToBanned" name="sendEmailToBanned" />
+					<span class="mdl-switch__label">[[admin/settings/email:sendEmailToBanned]]</span>
+				</label>
+			</div>
+
 			<div class="checkbox">
 				<label for="removeEmailNotificationImages" class="mdl-switch mdl-js-switch mdl-js-ripple-effect">
 					<input class="mdl-switch__input" type="checkbox" id="removeEmailNotificationImages" data-field="removeEmailNotificationImages" name="removeEmailNotificationImages" />
diff --git a/test/emailer.js b/test/emailer.js
index 190c6fd388..87d893dc50 100644
--- a/test/emailer.js
+++ b/test/emailer.js
@@ -8,6 +8,8 @@ const path = require('path');
 const db = require('./mocks/databasemock');
 const Plugins = require('../src/plugins');
 const Emailer = require('../src/emailer');
+const user = require('../src/user');
+const meta = require('../src/meta');
 const Meta = require('../src/meta');
 
 describe('emailer', () => {
@@ -138,4 +140,42 @@ describe('emailer', () => {
 			'email:custom:test': '',
 		}, done);
 	});
+
+	describe('emailer.send()', () => {
+		let senderUid;
+		let recipientUid;
+
+		before(async () => {
+			Plugins.hooks.register('emailer-test', {
+				hook: 'filter:email.send',
+				method: async () => {}, // noop
+			});
+
+			senderUid = await user.create({ username: 'sender' });
+			recipientUid = await user.create({ username: 'recipient', email: 'test@example.org' });
+			await user.email.confirmByUid(recipientUid);
+		});
+
+		it('should return false on attempted email send to a banned user', async () => {
+			await user.bans.ban(recipientUid);
+			const success = await Emailer.send('test', recipientUid, {});
+			assert.strictEqual(success, false);
+		});
+
+		it('should return true if the template is "banned"', async () => {
+			const success = await Emailer.send('banned', recipientUid, {});
+			assert.strictEqual(success, true);
+		});
+
+		it('should return true if system settings allow sending to banned users', async () => {
+			meta.config.sendEmailToBanned = 1;
+			const success = await Emailer.send('test', recipientUid, {});
+			assert.strictEqual(success, true);
+			meta.config.sendEmailToBanned = 0;
+		});
+
+		after(() => {
+			Plugins.hooks.unregister('emailer-test', 'filter:email.send');
+		});
+	});
 });