token_actions.module:

 function token_actions_send_email_action_validate($form, $form_state) {
  $form_values = $form_state['values'];
  if (!valid_email_address($form_values['recipient']) && strpos($form_values['recipient'], 'mail') === FALSE) {
    // We want the literal %mail placeholder to be emphasized in the error message.
    form_set_error('recipient', t('Enter a valid email address or use a token e-mail address such as %mail.', array('%mail' => '[mail]')));
  }
}

The IF statement fails (i.e. the contents of the recipient field validate) if the field contains the string 'mail'. For example "My Name <test@example.com>" (to name but a perfectly valid e-mail address) fails, but "test@test@gmail.example" (an invalid address) succeeds.

Is this intentional? Is this documented?

The comment below suggests that this may have to do with letting through tokens. If that were the case, testing for /\[[^\]]*\]/ (i.e. testing for matched square brackets) might be more useful, especially since valid_email_address() will not let square brackets through anyway.

Comments

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented

"My Name " is not valid - you have to enter it as "test@example.com" - this is the exact same validation as Drupal 7 core's actions.

brankoc’s picture

brankoc commented

RFC 5322 appears to agree with me:

Normally, a mailbox is composed of two parts: (1) an optional display name that indicates the name of the recipient (which can be a person or a system) that could be displayed to the user of a mail application, and (2) an addr-spec address enclosed in angle brackets ("<" and ">").

An addr-spec is a specific Internet identifier that contains a locally interpreted string followed by the at-sign character ("@", ASCII value 64) followed by an Internet domain.

The manual page for valid_email_address() mentions RFC 2822, but that one uses pretty much the same wording as RFC 5322.

I guess it's the fact that I had entered a valid e-mail address that contained the phrase 'mail' that had me stumped, as without checking the code there was no way of knowing what I had done wrong. Perhaps the error message could be worded in a way that makes it clear you should not use a display name. And I still think testing for square brackets might be better than testing for the word 'mail', as square brackets are not allowed in an e-mail address anyway.

Basically what you are now testing is "address is invalid" AND "address does not contain the word 'mail'", whereas what you probably want to be testing is "address is invalid" OR ("address is invalid" AND "address is not a token"). The first test fails if an address is invalid but contains the string 'mail', which is probably not what you want, especially with all the gmail addresses out there.

damienmckenna’s picture

damienmckenna
Location TN, USA
commented
Status: Active » Closed (won't fix)

This is a general problem with Drupal core's email address validation, not a problem specific to Token; see #265548: valid_email_address() is not RFC compliant.

brankoc’s picture

brankoc commented
Status: Closed (won't fix) » Active

The "refuses valid addresses" part of the bug is in the module, not in core.

Also, if the module's creator uses buggy PHP functions, it is the creator's obligation to document this for end users. Admittedly that would require two bug reports, but since these bugs are so tightly linked I will leave it to the module maintainers to request a second report or keep just the one.

dave reid’s picture

dave reid
he/him
Primary language English
Location Nebraska USA
commented
Issue summary: View changes
Status: Active » Closed (won't fix)