Fix: Input sanitation on google signin email (openemr#7356)

* Fix input sanitation on google signin email

* ValidationUtils::isValidEmail to validate email

* Refactor email validation into js function

* Syntax fixes to js

* Revert backend changes

* Fix PHP syntax issues

* Fix PHP syntax issues

interface/usergroup/user_admin.php

@@ -129,6 +129,14 @@ function submitform() {
         }
 
     }//If pwd null ends here
+
+    // Valiate Google email address (if provided)
+    if(document.forms[0].google_signin_email.value != "" && !isValidEmail(document.forms[0].google_signin_email.value)) {
+        flag=1;
+        alert(<?php echo xlj('Google email provided is invalid/not properly formatted (e.g. [email protected])') ?>);
+        return false;
+    }
+
 <?php } ?>
   if (document.forms[0].access_group_id) {
     var sel = getSelected(document.forms[0].access_group_id.options);

interface/usergroup/usergroup_admin_add.php

@@ -117,6 +117,12 @@ function submitform() {
         }
     } //secure_pwd if ends here
 
+    // Valiate Google email (if provided)
+    if(document.new_user.google_signin_email.value != "" && !isValidEmail(document.new_user.google_signin_email.value)) {
+        alert(<?php echo xlj('Google email provided is invalid/not properly formatted (e.g. [email protected])') ?>);
+        return false;
+    }
+
     <?php if ($GLOBALS['erx_enable']) { ?>
    alertMsg='';
    f=document.forms[0];

library/js/utility.js

@@ -543,3 +543,19 @@ if (typeof top.userDebug !== 'undefined' && (top.userDebug === '1' || top.userDe
     window.oeSMART = oeSMART;
 })(window, window.top.oeSMART || {});
 
+/*
+* @function isValidEmail(emailAddress)
+* @summary call this function where you need to validate an email address
+*  is formatted correctly, function will return bool true/false
+*
+* @param string An email address to validate, e.g. e.g. [email protected]
+*/
+function isValidEmail(emailAddress) {
+    // RegEx from https://owasp.org/www-community/OWASP_Validation_Regex_Repository
+    var mailformat = /^[a-zA-Z0-9_+&*-]+(?:\.[a-zA-Z0-9_+&*-]+)*@(?:[a-zA-Z0-9-]+\.)+[a-zA-Z]{2,}$/;
+    if (emailAddress.match(mailformat)) {
+        return true;
+    } else {
+        return false;
+    }
+}