Entity Reference recipient type sends emails to blocked users.

I've created a Merge Request for this issue.
The same change is also available as an attached patch file.

Thanks for working on this!

The change looks good to me.

Can we expand test coverage in \Drupal\Tests\workbench_email\Kernel\RecipientTypePluginsTest::testDelivery

It would entail:

* Changing line 84 to set a cardinality of 2

- $this->createEntityReferenceField('node', 'test', 'field_approver', 'Approver', 'user');
+ $this->createEntityReferenceField('node', 'test', 'field_approver', 'Approver', 'user', cardinality: 2);

And then this diff later

diff --git a/tests/src/Kernel/RecipientTypePluginsTest.php b/tests/src/Kernel/RecipientTypePluginsTest.php
index 419800d..968eb0e 100644
--- a/tests/src/Kernel/RecipientTypePluginsTest.php
+++ b/tests/src/Kernel/RecipientTypePluginsTest.php
@@ -208,12 +208,16 @@ class RecipientTypePluginsTest extends KernelTestBase {
     $transition->save();
     $this->assertContains('workbench_email.workbench_email_template.test', $transition->calculateDependencies()->getDependencies()['config']);
 
+    $blocked_user = $this->createUser(values: ['status' => 0]);
     $node = Node::create([
       'title' => 'test',
       'uid' => $this->author->id(),
       'type' => 'test',
       'field_email' => 'random@example.com',
-      'field_approver' => $this->approver->id(),
+      'field_approver' => [
+        ['target_id' => $this->approver->id()],
+        ['target_id' => $blocked_user->id()],
+      ],
       'revision_uid' => $this->lastAuthor->id(),
       'moderation_state' => 'draft',
     ]);

So two users in the field, but only one email in the test case.

Thanks

@larowlan

Thank you!

I've expanded the test coverage.

Please have a look when you have a moment.

larowlan → credited mstrelan → .

@mstrelan pointed out that this is technically a security issue.
I discussed it with the security team and they said it would be best to move this to a private discussion first.

I'll do that and add you @nakaza sora