From 88e3ba6a7b5cab5dbc2298e2a093d3aa383aa95f Mon Sep 17 00:00:00 2001
From: Yurii <yurikuzn@users.noreply.github.com>
Date: Tue, 24 Mar 2026 00:09:17 +0200
Subject: [PATCH] fix impot eml attachment

---
 .../Espo/Tools/Email/Api/PostImportEml.php    | 27 ++++++++++++++++++-
 .../Espo/Tools/Email/ImportEmlService.php     | 20 +-------------
 2 files changed, 27 insertions(+), 20 deletions(-)

diff --git a/application/Espo/Tools/Email/Api/PostImportEml.php b/application/Espo/Tools/Email/Api/PostImportEml.php
index 006bb779a4..2e11ac09e1 100644
--- a/application/Espo/Tools/Email/Api/PostImportEml.php
+++ b/application/Espo/Tools/Email/Api/PostImportEml.php
@@ -36,8 +36,11 @@ use Espo\Core\Api\Response;
 use Espo\Core\Api\ResponseComposer;
 use Espo\Core\Exceptions\BadRequest;
 use Espo\Core\Exceptions\Forbidden;
+use Espo\Core\Exceptions\NotFound;
+use Espo\Entities\Attachment;
 use Espo\Entities\Email;
 use Espo\Entities\User;
+use Espo\ORM\EntityManager;
 use Espo\Tools\Email\ImportEmlService;
 
 /**
@@ -49,6 +52,7 @@ class PostImportEml implements Action
         private Acl $acl,
         private User $user,
         private ImportEmlService $service,
+        private EntityManager $entityManager,
     ) {}
 
     public function process(Request $request): Response
@@ -61,11 +65,32 @@ class PostImportEml implements Action
             throw new BadRequest("No 'fileId'.");
         }
 
-        $email = $this->service->import($fileId, $this->user->getId());
+        $attachment = $this->getAttachment($fileId);
+
+        $email = $this->service->import($attachment, $this->user->getId());
 
         return ResponseComposer::json(['id' => $email->getId()]);
     }
 
+    /**
+     * @throws NotFound
+     * @throws Forbidden
+     */
+    private function getAttachment(string $fileId): Attachment
+    {
+        $attachment = $this->entityManager->getRDBRepositoryByClass(Attachment::class)->getById($fileId);
+
+        if (!$attachment) {
+            throw new NotFound("Attachment not found.");
+        }
+
+        if (!$this->acl->checkEntityRead($attachment)) {
+            throw new Forbidden("No access to attachment.");
+        }
+
+        return $attachment;
+    }
+
     /**
      * @throws Forbidden
      */
diff --git a/application/Espo/Tools/Email/ImportEmlService.php b/application/Espo/Tools/Email/ImportEmlService.php
index 6b42359b2b..d5fd394440 100644
--- a/application/Espo/Tools/Email/ImportEmlService.php
+++ b/application/Espo/Tools/Email/ImportEmlService.php
@@ -31,7 +31,6 @@ namespace Espo\Tools\Email;
 
 use Espo\Core\Exceptions\Conflict;
 use Espo\Core\Exceptions\Error;
-use Espo\Core\Exceptions\NotFound;
 use Espo\Core\FileStorage\Manager;
 use Espo\Core\Mail\Exceptions\ImapError;
 use Espo\Core\Mail\Importer;
@@ -56,16 +55,13 @@ class ImportEmlService
     /**
      * Import an EML.
      *
-     * @param string $fileId An attachment ID.
      * @param ?string $userId A user ID to relate an email with.
      * @return Email An Email.
-     * @throws NotFound
      * @throws Error
      * @throws Conflict
      */
-    public function import(string $fileId, ?string $userId = null): Email
+    public function import(Attachment $attachment, ?string $userId = null): Email
     {
-        $attachment = $this->getAttachment($fileId);
         $contents = $this->fileStorageManager->getContents($attachment);
 
         try {
@@ -93,20 +89,6 @@ class ImportEmlService
         return $email;
     }
 
-    /**
-     * @throws NotFound
-     */
-    private function getAttachment(string $fileId): Attachment
-    {
-        $attachment = $this->entityManager->getRDBRepositoryByClass(Attachment::class)->getById($fileId);
-
-        if (!$attachment) {
-            throw new NotFound("Attachment not found.");
-        }
-
-        return $attachment;
-    }
-
     /**
      * @throws Conflict
      */