| @@ -108,9 +108,31 @@ | ||
| 108 | 108 | if ( ! $in_house && ! preg_match( '/^[\p{L}\s\-\']+$/u', $name ) ) { |
| 109 | 109 | return new Response( false, array( 'message' => esc_html__( 'Only letters, spaces, hyphens and apostrophes allowed.', 'defender-security' ) ) ); |
| 110 | 110 | } |
| 111 | 111 | |
| 112 | - if ( empty( $statuses ) ) { | |
| 112 | + // Block duplicate recipient emails. Messages render as React text, so keep them unescaped. | |
| 113 | + if ( $this->recipient_directory->email_exists( $email ) ) { | |
| 114 | + return new Response( | |
| 115 | + false, | |
| 116 | + array( | |
| 117 | + 'message' => __( 'This email address is already added as a recipient. Edit the existing recipient to add more report types.', 'defender-security' ), | |
| 118 | + 'code' => 'recipient_notice', | |
| 119 | + ) | |
| 120 | + ); | |
| 121 | + } | |
| 122 | + | |
| 123 | + // Registered users must be added via user search, not invited by email. | |
| 124 | + if ( ! $in_house && get_user_by( 'email', $email ) ) { | |
| 125 | + return new Response( | |
| 126 | + false, | |
| 127 | + array( | |
| 128 | + 'message' => __( "Registered user email can't be invited, you can add them directly at Search WordPress user tab.", 'defender-security' ), | |
| 129 | + 'code' => 'recipient_notice', | |
| 130 | + ) | |
| 131 | + ); | |
| 132 | + } | |
| 133 | + | |
| 134 | + if ( array() === $statuses ) { | |
| 113 | 135 | return new Response( false, array( 'message' => esc_html__( 'Please enable at least one notification module before inviting a recipient.', 'defender-security' ) ) ); |
| 114 | 136 | } |
| 115 | 137 | |
| 116 | 138 | $subscriber = array( |
