From d8890750ca8dd9e2e299194ca854ffde6958504a Mon Sep 17 00:00:00 2001
From: Antoine Nguyen <tonio@ngyn.org>
Date: Wed, 12 Nov 2025 14:58:12 +0100
Subject: [PATCH] Fixed wrong logic to cover disallow all external domains use
 case.

---
 .../domains/form_steps/DomainPolicyForm.vue   | 20 -------------------
 modoboa/admin/models/alias.py                 |  2 +-
 modoboa/admin/tests/test_alias_targets.py     | 12 +++++++++++
 3 files changed, 13 insertions(+), 21 deletions(-)
 delete mode 100644 frontend/src/components/admin/domains/form_steps/DomainPolicyForm.vue

diff --git a/frontend/src/components/admin/domains/form_steps/DomainPolicyForm.vue b/frontend/src/components/admin/domains/form_steps/DomainPolicyForm.vue
deleted file mode 100644
index 31f8a8720..000000000
--- a/frontend/src/components/admin/domains/form_steps/DomainPolicyForm.vue
+++ /dev/null
@@ -1,20 +0,0 @@
-<template>
-  <v-form ref="vFormRef">
-    <v-switch
-      v-model="model.bypass_virus_checks"
-      :label="$gettext('Bypass virus checks')"
-    />
-  </v-form>
-</template>
-
-<script setup>
-import { ref } from 'vue'
-
-const model = defineModel()
-
-const vFormRef = ref()
-
-defineExpose({
-  vFormRef,
-})
-</script>
diff --git a/modoboa/admin/models/alias.py b/modoboa/admin/models/alias.py
index 83f2413cc..62cc73e0f 100644
--- a/modoboa/admin/models/alias.py
+++ b/modoboa/admin/models/alias.py
@@ -105,7 +105,7 @@ def is_alias_target_allowed(domain: str) -> bool:
             return False
     else:
         allowed_domains = params.get("alias_target_allow_list")
-        if allowed_domains and domain not in convert_to_list(allowed_domains):
+        if not allowed_domains or domain not in convert_to_list(allowed_domains):
             return False
     return True
 
diff --git a/modoboa/admin/tests/test_alias_targets.py b/modoboa/admin/tests/test_alias_targets.py
index bce94aaf3..851550154 100644
--- a/modoboa/admin/tests/test_alias_targets.py
+++ b/modoboa/admin/tests/test_alias_targets.py
@@ -28,6 +28,18 @@ class AliasTargetSettingsTestCase(ModoAPITestCase):
         self.assertEqual(resp.status_code, 400)
         self.assertEqual(resp.json()["error"], "Target domain not allowed: bad.com")
 
+    def test_block_external_domains(self):
+        self.set_global_parameter("alias_can_target_any_domain", False, app="admin")
+        # Now try an external domain, should fail
+        values = {
+            "address": "list4@test.com",
+            "recipients": ["user@bad.com"],
+            "enabled": True,
+        }
+        resp = self.client.post(reverse("v2:alias-list"), values, format="json")
+        self.assertEqual(resp.status_code, 400)
+        self.assertEqual(resp.json()["error"], "Target domain not allowed: bad.com")
+
     def test_allow_only_list_when_any_disallowed(self):
         # alias_can_target_any_domain = False and allow list contains domain
         self.set_global_parameter("alias_can_target_any_domain", False, app="admin")