From c402a943e655808c474505daa0a3ce497942d738 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marcel=20L=C3=B6rtscher?= <marcel.loertscher@visol.ch>
Date: Wed, 11 Feb 2026 10:53:48 +0100
Subject: [PATCH] bugfix: Validate email format on import

---
 Classes/Controller/UserimportController.php | 20 ++++++++++++++++++++
 Classes/Service/UserImportService.php       |  9 +++++++++
 2 files changed, 29 insertions(+)

diff --git a/Classes/Controller/UserimportController.php b/Classes/Controller/UserimportController.php
index 78e3ea7..57d6b03 100644
--- a/Classes/Controller/UserimportController.php
+++ b/Classes/Controller/UserimportController.php
@@ -16,6 +16,7 @@
 use Psr\Http\Message\ResponseInterface;
 use TYPO3\CMS\Backend\Template\ModuleTemplateFactory;
 use TYPO3\CMS\Core\Configuration\ExtensionConfiguration;
+use TYPO3\CMS\Core\Type\ContextualFeedbackSeverity;
 use TYPO3\CMS\Core\Utility\GeneralUtility;
 use TYPO3\CMS\Extbase\Domain\Model\FileReference;
 use TYPO3\CMS\Extbase\Mvc\Controller\ActionController;
@@ -169,6 +170,25 @@ public function importPreviewAction(ImportJob $importJob, array $fieldMapping):
         $previewData = $this->spreadsheetService->generateDataFromImportJob($importJob, true);
         $this->view->assign('previewDataHeader', array_keys($previewData[0]));
         $this->view->assign('previewData', $previewData);
+
+        // Validate email addresses in mapped data
+        $invalidEmails = [];
+        $useEmailAsUsername = (bool) $importJob->getImportOption(ImportJob::IMPORT_OPTION_USE_EMAIL_AS_USERNAME);
+        foreach ($previewData as $row) {
+            if (isset($row['email']) && !filter_var($row['email'], FILTER_VALIDATE_EMAIL)) {
+                $invalidEmails[] = $row['email'];
+            } elseif ($useEmailAsUsername && isset($row['username']) && !filter_var($row['username'], FILTER_VALIDATE_EMAIL)) {
+                $invalidEmails[] = $row['username'];
+            }
+        }
+        if (!empty($invalidEmails)) {
+            $this->addFlashMessage(
+                'The following email addresses are invalid and will be skipped during import: '
+                . implode(', ', $invalidEmails),
+                'Invalid email addresses detected',
+                ContextualFeedbackSeverity::WARNING
+            );
+        }
         return $this->view->renderResponse('Userimport/ImportPreview');
     }
 
diff --git a/Classes/Service/UserImportService.php b/Classes/Service/UserImportService.php
index bb4cc90..be563c5 100644
--- a/Classes/Service/UserImportService.php
+++ b/Classes/Service/UserImportService.php
@@ -45,6 +45,15 @@ public function performImport(ImportJob $importJob, array $rowsToImport = [])
         foreach ($rowsToImport as $row) {
             $rowForLog = LogUtility::formatRowForImportLog($row);
 
+            // Validate email format if email field is present
+            if (isset($row['email']) && !filter_var($row['email'], FILTER_VALIDATE_EMAIL)) {
+                $log[] = [
+                    'action' => 'skip.invalidEmail',
+                    'row' => $rowForLog,
+                ];
+                continue;
+            }
+
             if ($updateExisting) {
                 $targetFolder = (int) $importJob->getImportOption(ImportJob::IMPORT_OPTION_TARGET_FOLDER);
                 $updateExistingUniqueField = $importJob->getImportOption(ImportJob::IMPORT_OPTION_UPDATE_EXISTING_USERS_UNIQUE_FIELD);