Prevent creation of same alias addresses using different case

fix #3134

modoboa/admin/api/v1/serializers.py

@@ -469,7 +469,7 @@ class AliasSerializer(serializers.ModelSerializer):
         """Check domain."""
         local_part, self.domain = admin_models.validate_alias_address(
             value, self.context["request"].user, instance=self.instance)
-        return value
+        return value.lower()
 
     def create(self, validated_data):
         """Create appropriate objects."""
@@ -498,13 +498,13 @@ class SenderAddressSerializer(serializers.ModelSerializer):
 
     def validate_address(self, value):
         """Check domain."""
-        local_part, domain = email_utils.split_mailbox(value)
+        local_part, domain = email_utils.split_mailbox(value.lower())
         domain = admin_models.Domain.objects.filter(name=domain).first()
         user = self.context["request"].user
         if domain and not user.can_access(domain):
             raise serializers.ValidationError(
                 _("You don't have access to this domain."))
-        return value
+        return value.lower()
 
     def validate_mailbox(self, value):
         """Check permission."""

modoboa/admin/api/v1/tests.py

@@ -678,6 +678,17 @@ class AliasAPITestCase(ModoAPITestCase):
         response = self.client.post(url, data, format="json")
         self.assertEqual(response.status_code, 201)
 
+    def test_create_duplicate_alias(self):
+        url = reverse("v1:alias-list")
+        response = self.client.post(url, self.ALIAS_DATA, format="json")
+        self.assertEqual(response.status_code, 201)
+
+        # Try with same address but different case
+        data = copy.deepcopy(self.ALIAS_DATA)
+        data["address"] = "ALIAS_fromapi@test.com"
+        response = self.client.post(url, data, format="json")
+        self.assertEqual(response.status_code, 400)
+
     def test_create_alias_as_domadmin(self):
         """As DomainAdmin, try to create a new alias."""
         self.client.credentials(

modoboa/admin/models/alias.py

@@ -28,7 +28,7 @@ def validate_alias_address(
         address, creator, internal=False, instance=None, ignore_existing=False
         ):
     """Check if the given alias address can be created by creator."""
-    local_part, domain = split_mailbox(address)
+    local_part, domain = split_mailbox(address.lower())
     domain = Domain.objects.filter(name=domain).first()
     if domain is None:
         raise ValidationError(_("Domain not found."))