From 9fb59173fc98f8666bbde674be286809da0ab610 Mon Sep 17 00:00:00 2001
From: Luc Didry <luc@didry.org>
Date: Oct 28 2018 13:41:29 +0000
Subject: Fix #129 — Add constraints on mail sending to prevent spam sending


---

diff --git a/CHANGELOG b/CHANGELOG
index 35b9382..a33825c 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -19,6 +19,8 @@ Revision history for Lufi
 	- Display max size on upload page
 	- Add CSRF token challenge on login
 	- Add CSRF token challenge on logout
+	- Add constraints on mail sending to prevent spam sending (not perfect, but
+	should be good enough)
 
 0.02.2 2017-09-18
 	- Fix cron tasks bug
diff --git a/cpanfile b/cpanfile
index fe52888..93e8979 100644
--- a/cpanfile
+++ b/cpanfile
@@ -20,6 +20,7 @@ requires 'Data::Entropy';
 requires 'Crypt::SaltedHash';
 requires 'Data::Validate::URI';
 requires 'Term::ProgressBar';
+requires 'URI::Find';
 
 # Mojolicious optional deps
 feature 'optional_deps' => sub {
diff --git a/cpanfile.snapshot b/cpanfile.snapshot
index 9b5427a..d922399 100644
--- a/cpanfile.snapshot
+++ b/cpanfile.snapshot
@@ -1749,6 +1749,16 @@ DISTRIBUTIONS
       strict 0
       utf8 0
       warnings 0
+  URI-Find-20160806
+    pathname: M/MS/MSCHWERN/URI-Find-20160806.tar.gz
+    provides:
+      URI::Find 20160806
+      URI::Find::Schemeless 20160806
+    requirements:
+      Module::Build 0.30
+      Test::More 0.88
+      URI 1.60
+      perl v5.8.8
   URI-Nested-0.10
     pathname: D/DW/DWHEELER/URI-Nested-0.10.tar.gz
     provides:
diff --git a/lib/Lufi/Controller/Mail.pm b/lib/Lufi/Controller/Mail.pm
index bbfbfbe..2dbb466 100644
--- a/lib/Lufi/Controller/Mail.pm
+++ b/lib/Lufi/Controller/Mail.pm
@@ -1,13 +1,17 @@
 # vim:set sw=4 ts=4 sts=4 ft=perl expandtab:
 package Lufi::Controller::Mail;
 use Mojo::Base 'Mojolicious::Controller';
-use Email::Valid;
 use Mojo::JSON qw(decode_json);
+use Mojo::URL;
+use Email::Valid;
+use URI::Find;
 
 sub render_mail {
     my $c = shift;
     my $links = (defined($c->param('links'))) ? decode_json($c->param('links')) : [];
 
+    $c->redirect_to('/') unless (scalar(@{$links}));
+
     $c->render(
         template => 'mail',
         links    => $links
@@ -20,7 +24,34 @@ sub send_mail {
     my $validation = $c->validation;
     return $c->render(text => $c->l('Bad CSRF token!'), status => 403) if $validation->csrf_protect->has_error('csrf_token');
 
-    my $emails = $c->param('emails');
+    my $emails  = $c->param('emails');
+    my $body    = $c->param('body');
+    my $subject = $c->param('subject');
+    my $msg     = '';
+
+    my $base_url  = $c->req->url->to_abs->path('/r/');
+    my $fixed_url = $base_url;
+    if ($c->config('fixed_domain')) {
+        $fixed_url->host($c->config('fixed_domain'));
+    }
+    my $at_least_one_instance_url = 0;
+    my $finder = URI::Find->new(sub {
+        my ($uri, $orig_uri) = @_;
+        $uri = Mojo::URL->new($uri);
+        if ($uri->host ne $base_url->to_abs->host && $uri->host ne $fixed_url->to_abs->host) {
+            $msg .= $c->l('You can\'t add URLs that are not related to this instance.').'<br>';
+        } elsif (index($orig_uri, $fixed_url->to_abs->to_string) > -1) {
+            $at_least_one_instance_url = 1;
+        }
+        return $orig_uri;
+    });
+    $finder->find(\$body);
+    $finder->find(\$subject);
+
+    $c->debug($at_least_one_instance_url);
+    unless ($at_least_one_instance_url) {
+        $msg .= $c->l('The body of the mail must contain at least one URL pointing to a file hosted on this instance.').'<br>';
+    }
 
     $emails =~ s/ //g;
     my @a   = split(',', $emails);
@@ -33,23 +64,23 @@ sub send_mail {
         }
     }
 
-    my $msg = '';
     if (scalar(@bad)) {
-        $msg .= $c->l('The following email addresses are not valid: %1', join(', ', @bad))."\n";
+        $msg .= $c->l('The following email addresses are not valid: %1', join(', ', @bad)).'<br>';
     }
 
-    $msg .= $c->l('You must give email addresses.')."\n"     unless (scalar(@a));
-    $msg .= $c->l('The email subject can\'t be empty.')."\n" unless ($c->param('subject'));
-    $msg .= $c->l('The email body can\'t be empty.')."\n"    unless ($c->param('body'));
+    $msg .= $c->l('You must give email addresses.').'<br>'     unless (scalar(@a));
+    $msg .= $c->l('The email subject can\'t be empty.').'<br>' unless ($subject);
+    $msg .= $c->l('The email body can\'t be empty.').'<br>'    unless ($body);
 
     if ($msg) {
         return $c->render(
             template => 'mail',
             msg      => $msg,
+            links    => [],
             values   => {
                 emails  => $emails,
-                subject => $c->param('subject'),
-                body    => $c->param('body')
+                subject => $subject,
+                body    => $body
             }
         )
     }
@@ -57,8 +88,8 @@ sub send_mail {
     $c->mail(
         from    => $c->config('mail_sender'),
         bcc     => $emails,
-        subject => $c->param('subject'),
-        data    => $c->param('body')
+        subject => $subject,
+        data    => $body
     );
 
     return $c->render(
diff --git a/themes/default/lib/Lufi/I18N/ca.po b/themes/default/lib/Lufi/I18N/ca.po
index 4480115..bcb0661 100644
--- a/themes/default/lib/Lufi/I18N/ca.po
+++ b/themes/default/lib/Lufi/I18N/ca.po
@@ -56,6 +56,10 @@ msgstr "Quant a"
 msgid "Add a password to file(s)"
 msgstr ""
 
+#: themes/default/templates/mail.html.ep:16
+msgid "Adding URLs not related to this Lufi instance to the mail body or subject is prohibited."
+msgstr ""
+
 #: themes/default/templates/about.html.ep:18
 msgid "As Lufi is a free software licensed under of the terms of the <a href=\"https://gnu.org/licenses/agpl.html\" class=\"classic\">AGPLv3</a>, you can install it on you own server. Have a look on the <a href=\"https://framagit.org/luc/lufi/wikis/home\" class=\"classic\">Wiki</a> for the procedure."
 msgstr "Com que Lufi és programari lliure, autoritzat sota els termes de l'<a href=\"https://gnu.org/licenses/agpl.html\" class=\"classic\">AGPLv3</a>, el podeu instal·lar al vostre propi servidor. Pel que fa a com fer-ho, feu un cop d'ull al <a href=\"https://framagit.org/luc/lufi/wikis/home\" class=\"classic\">Wiki</a>."
@@ -69,7 +73,7 @@ msgstr "Demanem la part XX1 de %1 del fitxer"
 msgid "Back to homepage"
 msgstr "Retorna a la pàgina d'inici"
 
-#: lib/Lufi/Controller/Mail.pm:21
+#: lib/Lufi/Controller/Mail.pm:25
 msgid "Bad CSRF token!"
 msgstr "Mal testimoni CSRF!"
 
@@ -89,7 +93,7 @@ msgstr "Premeu per obrir la selecció de fitxer."
 msgid "Close"
 msgstr "Tanca"
 
-#: themes/default/templates/mail.html.ep:22
+#: themes/default/templates/mail.html.ep:23
 msgid "Comma-separated email addresses"
 msgstr "Adreces de correu electrònic separades per comes"
 
@@ -153,15 +157,15 @@ msgstr "Arrossegueu i deixeu anar fitxers a l'àrea apropiada o useu el sistema 
 msgid "Drop files here"
 msgstr "Deixeu anar aquí fitxers."
 
-#: themes/default/templates/mail.html.ep:38
+#: themes/default/templates/mail.html.ep:39
 msgid "Email body"
 msgstr "Cos del correu electrònic"
 
-#: themes/default/templates/mail.html.ep:30
+#: themes/default/templates/mail.html.ep:31
 msgid "Email subject"
 msgstr "Assumpte del correu electrònic"
 
-#: themes/default/templates/mail.html.ep:24 themes/default/templates/mail.html.ep:26
+#: themes/default/templates/mail.html.ep:25 themes/default/templates/mail.html.ep:27
 msgid "Emails"
 msgstr "correus electrònics"
 
@@ -205,10 +209,6 @@ msgstr "Nom de fitxer"
 msgid "Files deleted at first download"
 msgstr ""
 
-#: themes/default/templates/mail.html.ep:46
-msgid "Free field"
-msgstr ""
-
 #: themes/default/templates/partial/render.js.ep:8
 msgid "Get the file"
 msgstr "Obté el fitxer"
@@ -221,7 +221,7 @@ msgstr "Obteniu el codi font al <a href=\"https://framagit.org/luc/lufi\" class=
 msgid "Hello,\\n\\nHere's some files I want to share with you:\\n"
 msgstr "Hola,\\n\\nVe't aquí uns fitxers que vull compartir amb tu:"
 
-#: themes/default/templates/mail.html.ep:34
+#: themes/default/templates/mail.html.ep:35
 msgid "Here's some files"
 msgstr "Ve't aquí uns fitxers"
 
@@ -348,11 +348,11 @@ msgstr "Les files en vermell indiquen que els fitxers han expirat i ja no són d
 msgid "Send all links by email"
 msgstr "Envia tots els enllaços per correu electrònic"
 
-#: themes/default/templates/mail.html.ep:53
+#: themes/default/templates/mail.html.ep:46
 msgid "Send with this server"
 msgstr "Envia amb aquest servidor"
 
-#: themes/default/templates/mail.html.ep:54
+#: themes/default/templates/mail.html.ep:47
 msgid "Send with your own mail software"
 msgstr "Envia amb el vostre propi programa de correu"
 
@@ -383,15 +383,19 @@ msgstr ""
 "L'administrador només pot veure el nom del fitxer, la seva mida i el seu\n"
 "mimetype (quina mena de fitxer és: vídeo, text, etc.)"
 
+#: lib/Lufi/Controller/Mail.pm:53
+msgid "The body of the mail must contain at least one URL pointing to a file hosted on this instance."
+msgstr ""
+
 #: themes/default/templates/partial/files.js.ep:11
 msgid "The data has been successfully imported."
 msgstr "La importació de les dades ha reeixit."
 
-#: lib/Lufi/Controller/Mail.pm:43
+#: lib/Lufi/Controller/Mail.pm:73
 msgid "The email body can't be empty."
 msgstr "El cos del correu no pot estar buit."
 
-#: lib/Lufi/Controller/Mail.pm:42
+#: lib/Lufi/Controller/Mail.pm:72
 msgid "The email subject can't be empty."
 msgstr "L'assumpte dle correu no pot estar buit."
 
@@ -404,7 +408,7 @@ msgid "The files uploaded on a Lufi instance are encrypted before the upload to 
 msgstr "Els fitxers que es pugen a una instaŀlació de Lufi són xifrats abans de pujar-los al servidor i l'administrador del servidor no pot veure el contingut del fitxer."
 
 #. (join(', ', @bad)
-#: lib/Lufi/Controller/Mail.pm:38
+#: lib/Lufi/Controller/Mail.pm:68
 msgid "The following email addresses are not valid: %1"
 msgstr "Les següents adreces de correu electrònic no són vàlides: %1"
 
@@ -412,7 +416,7 @@ msgstr "Les següents adreces de correu electrònic no són vàlides: %1"
 msgid "The link(s) has been copied to your clipboard"
 msgstr "L'enllaç/ els enllaços ja estan copiats al portaretalls"
 
-#: lib/Lufi/Controller/Mail.pm:66
+#: lib/Lufi/Controller/Mail.pm:97
 msgid "The mail has been sent."
 msgstr "El correu ja està enviat."
 
@@ -479,6 +483,10 @@ msgstr "Qui va escriure aquest programa?"
 msgid "You can see the list of your files by clicking on the \"My files\" link at the top right of this page."
 msgstr "Podeu veure la llista dels vostres fitxers amb a l'enllaç \"Els meus fitxers\" a dalt a la dreta d'aquesta pàgina."
 
+#: lib/Lufi/Controller/Mail.pm:42
+msgid "You can't add URLs that are not related to this instance."
+msgstr ""
+
 #: themes/default/templates/about.html.ep:8
 msgid "You don't need to register yourself to upload files but be aware that, for legal reasons, your IP address will be stored when you send a file. Don't panic, this is normally the case for all sites on which you send files."
 msgstr "No cal que us inscriviu per a pujar fitxers però tingueu en compte, que per raons legals, s'enregistrarà la vostra adreça IP quan envieu un fitxer. No us espanteu, això és el que normalment passa a tots els webs on pugeu fitxers."
@@ -499,7 +507,7 @@ msgstr "Heu intentat deixar aquesta pàgina. Es canceŀlarà la pujada. N'esteu 
 msgid "You have been successfully logged out."
 msgstr "Heu sortit correctament."
 
-#: lib/Lufi/Controller/Mail.pm:41
+#: lib/Lufi/Controller/Mail.pm:71
 msgid "You must give email addresses."
 msgstr "Heu de donar l'adreça de correu electrònic."
 
diff --git a/themes/default/lib/Lufi/I18N/en.po b/themes/default/lib/Lufi/I18N/en.po
index 57169d0..53e85e1 100644
--- a/themes/default/lib/Lufi/I18N/en.po
+++ b/themes/default/lib/Lufi/I18N/en.po
@@ -53,6 +53,10 @@ msgstr ""
 msgid "Add a password to file(s)"
 msgstr ""
 
+#: themes/default/templates/mail.html.ep:16
+msgid "Adding URLs not related to this Lufi instance to the mail body or subject is prohibited."
+msgstr ""
+
 #: themes/default/templates/about.html.ep:18
 msgid "As Lufi is a free software licensed under of the terms of the <a href=\"https://gnu.org/licenses/agpl.html\" class=\"classic\">AGPLv3</a>, you can install it on you own server. Have a look on the <a href=\"https://framagit.org/luc/lufi/wikis/home\" class=\"classic\">Wiki</a> for the procedure."
 msgstr ""
@@ -66,7 +70,7 @@ msgstr ""
 msgid "Back to homepage"
 msgstr ""
 
-#: lib/Lufi/Controller/Mail.pm:21
+#: lib/Lufi/Controller/Mail.pm:25
 msgid "Bad CSRF token!"
 msgstr ""
 
@@ -86,7 +90,7 @@ msgstr ""
 msgid "Close"
 msgstr ""
 
-#: themes/default/templates/mail.html.ep:22
+#: themes/default/templates/mail.html.ep:23
 msgid "Comma-separated email addresses"
 msgstr ""
 
@@ -150,15 +154,15 @@ msgstr ""
 msgid "Drop files here"
 msgstr ""
 
-#: themes/default/templates/mail.html.ep:38
+#: themes/default/templates/mail.html.ep:39
 msgid "Email body"
 msgstr ""
 
-#: themes/default/templates/mail.html.ep:30
+#: themes/default/templates/mail.html.ep:31
 msgid "Email subject"
 msgstr ""
 
-#: themes/default/templates/mail.html.ep:24 themes/default/templates/mail.html.ep:26
+#: themes/default/templates/mail.html.ep:25 themes/default/templates/mail.html.ep:27
 msgid "Emails"
 msgstr ""
 
@@ -202,10 +206,6 @@ msgstr ""
 msgid "Files deleted at first download"
 msgstr ""
 
-#: themes/default/templates/mail.html.ep:46
-msgid "Free field"
-msgstr ""
-
 #: themes/default/templates/partial/render.js.ep:8
 msgid "Get the file"
 msgstr ""
@@ -218,7 +218,7 @@ msgstr ""
 msgid "Hello,\\n\\nHere's some files I want to share with you:\\n"
 msgstr ""
 
-#: themes/default/templates/mail.html.ep:34
+#: themes/default/templates/mail.html.ep:35
 msgid "Here's some files"
 msgstr ""
 
@@ -344,11 +344,11 @@ msgstr ""
 msgid "Send all links by email"
 msgstr ""
 
-#: themes/default/templates/mail.html.ep:53
+#: themes/default/templates/mail.html.ep:46
 msgid "Send with this server"
 msgstr ""
 
-#: themes/default/templates/mail.html.ep:54
+#: themes/default/templates/mail.html.ep:47
 msgid "Send with your own mail software"
 msgstr ""
 
@@ -377,15 +377,19 @@ msgstr ""
 msgid "The administrator can only see the file's name, its size and its mimetype (what kind of file it is: video, text, etc.)."
 msgstr ""
 
+#: lib/Lufi/Controller/Mail.pm:53
+msgid "The body of the mail must contain at least one URL pointing to a file hosted on this instance."
+msgstr ""
+
 #: themes/default/templates/partial/files.js.ep:11
 msgid "The data has been successfully imported."
 msgstr ""
 
-#: lib/Lufi/Controller/Mail.pm:43
+#: lib/Lufi/Controller/Mail.pm:73
 msgid "The email body can't be empty."
 msgstr ""
 
-#: lib/Lufi/Controller/Mail.pm:42
+#: lib/Lufi/Controller/Mail.pm:72
 msgid "The email subject can't be empty."
 msgstr ""
 
@@ -398,7 +402,7 @@ msgid "The files uploaded on a Lufi instance are encrypted before the upload to 
 msgstr ""
 
 #. (join(', ', @bad)
-#: lib/Lufi/Controller/Mail.pm:38
+#: lib/Lufi/Controller/Mail.pm:68
 msgid "The following email addresses are not valid: %1"
 msgstr ""
 
@@ -406,7 +410,7 @@ msgstr ""
 msgid "The link(s) has been copied to your clipboard"
 msgstr ""
 
-#: lib/Lufi/Controller/Mail.pm:66
+#: lib/Lufi/Controller/Mail.pm:97
 msgid "The mail has been sent."
 msgstr ""
 
@@ -473,6 +477,10 @@ msgstr ""
 msgid "You can see the list of your files by clicking on the \"My files\" link at the top right of this page."
 msgstr ""
 
+#: lib/Lufi/Controller/Mail.pm:42
+msgid "You can't add URLs that are not related to this instance."
+msgstr ""
+
 #: themes/default/templates/about.html.ep:8
 msgid "You don't need to register yourself to upload files but be aware that, for legal reasons, your IP address will be stored when you send a file. Don't panic, this is normally the case for all sites on which you send files."
 msgstr ""
@@ -493,7 +501,7 @@ msgstr ""
 msgid "You have been successfully logged out."
 msgstr ""
 
-#: lib/Lufi/Controller/Mail.pm:41
+#: lib/Lufi/Controller/Mail.pm:71
 msgid "You must give email addresses."
 msgstr ""
 
diff --git a/themes/default/lib/Lufi/I18N/fr.po b/themes/default/lib/Lufi/I18N/fr.po
index 3c8e0cb..2036774 100644
--- a/themes/default/lib/Lufi/I18N/fr.po
+++ b/themes/default/lib/Lufi/I18N/fr.po
@@ -55,6 +55,10 @@ msgstr "À propos"
 msgid "Add a password to file(s)"
 msgstr "Ajouter un mot de passe au(x) fichier(s)"
 
+#: themes/default/templates/mail.html.ep:16
+msgid "Adding URLs not related to this Lufi instance to the mail body or subject is prohibited."
+msgstr "L’ajout d’URL non liées à cette instance Lufi au corps ou au sujet du mail est interdit."
+
 #: themes/default/templates/about.html.ep:18
 msgid "As Lufi is a free software licensed under of the terms of the <a href=\"https://gnu.org/licenses/agpl.html\" class=\"classic\">AGPLv3</a>, you can install it on you own server. Have a look on the <a href=\"https://framagit.org/luc/lufi/wikis/home\" class=\"classic\">Wiki</a> for the procedure."
 msgstr "Comme Lufi est un logiciel libre soumis aux termes de la license <a href=\"https://gnu.org/licenses/agpl.html\" class=\"classic\">AGPLv3</a>, vous pouvez l’installer sur votre propre serveur. Veuillez consulter le <a href=\"https://framagit.org/luc/lufi/wikis/home\" class=\"classic\">Wiki</a> pour voir la procédure."
@@ -68,13 +72,13 @@ msgstr "Demande de récupération du fragment de fichier XX1 sur %1"
 msgid "Back to homepage"
 msgstr "Retour à la page d’accueil"
 
-#: lib/Lufi/Controller/Mail.pm:21
+#: lib/Lufi/Controller/Mail.pm:25
 msgid "Bad CSRF token!"
 msgstr "Mauvais jeton CSRF !"
 
 #: lib/Lufi/Controller/Auth.pm:22 lib/Lufi/Controller/Auth.pm:39
 msgid "Bad CSRF token."
-msgstr ""
+msgstr "Jeton CSRF invalide."
 
 #: themes/default/templates/partial/render.js.ep:5
 msgid "Click here to refresh the page and restart the download."
@@ -88,7 +92,7 @@ msgstr "Cliquez pour ouvrir le navigateur de fichiers"
 msgid "Close"
 msgstr "Fermer"
 
-#: themes/default/templates/mail.html.ep:22
+#: themes/default/templates/mail.html.ep:23
 msgid "Comma-separated email addresses"
 msgstr "Adresses mails séparées par des virgules"
 
@@ -152,15 +156,15 @@ msgstr "Faites glisser des fichiers dans la zone prévue à cet effet ou sélect
 msgid "Drop files here"
 msgstr "Glissez vos fichiers ici"
 
-#: themes/default/templates/mail.html.ep:38
+#: themes/default/templates/mail.html.ep:39
 msgid "Email body"
 msgstr "Corps du mail"
 
-#: themes/default/templates/mail.html.ep:30
+#: themes/default/templates/mail.html.ep:31
 msgid "Email subject"
 msgstr "Sujet du mail"
 
-#: themes/default/templates/mail.html.ep:24 themes/default/templates/mail.html.ep:26
+#: themes/default/templates/mail.html.ep:25 themes/default/templates/mail.html.ep:27
 msgid "Emails"
 msgstr "Mails"
 
@@ -204,10 +208,6 @@ msgstr "Nom du fichier"
 msgid "Files deleted at first download"
 msgstr "Fichiers supprimés au premier téléchargement"
 
-#: themes/default/templates/mail.html.ep:46
-msgid "Free field"
-msgstr ""
-
 #: themes/default/templates/partial/render.js.ep:8
 msgid "Get the file"
 msgstr "Récupérer le fichier"
@@ -220,7 +220,7 @@ msgstr "Récupérez le code source sur <a href=\"https://framagit.org/luc/lufi\"
 msgid "Hello,\\n\\nHere's some files I want to share with you:\\n"
 msgstr "Bonjour,\\n\\nVoici quelques fichiers que je souhaite partager avec toi :\\n"
 
-#: themes/default/templates/mail.html.ep:34
+#: themes/default/templates/mail.html.ep:35
 msgid "Here's some files"
 msgstr "Voici quelques fichiers"
 
@@ -346,11 +346,11 @@ msgstr "Les lignes en rouge indiquent que le fichier a expiré et n’est plus d
 msgid "Send all links by email"
 msgstr "Envoyer tous les liens par mail"
 
-#: themes/default/templates/mail.html.ep:53
+#: themes/default/templates/mail.html.ep:46
 msgid "Send with this server"
 msgstr "Envoyer avec ce serveur"
 
-#: themes/default/templates/mail.html.ep:54
+#: themes/default/templates/mail.html.ep:47
 msgid "Send with your own mail software"
 msgstr "Envoyer avec votre propre logiciel de mail"
 
@@ -383,15 +383,19 @@ msgstr "Désolé, l’envoi de fichier est désactivé."
 msgid "The administrator can only see the file's name, its size and its mimetype (what kind of file it is: video, text, etc.)."
 msgstr "L’administrateur ne peut voir que le nom du fichier, sa taille et son type mime (son type de fichier : vidéo, texte, etc.)."
 
+#: lib/Lufi/Controller/Mail.pm:53
+msgid "The body of the mail must contain at least one URL pointing to a file hosted on this instance."
+msgstr "Le corps du mail doit contenir au moins une URL pointant vers un fichier hébergé sur cette instance."
+
 #: themes/default/templates/partial/files.js.ep:11
 msgid "The data has been successfully imported."
 msgstr "Les données ont été importées avec succès."
 
-#: lib/Lufi/Controller/Mail.pm:43
+#: lib/Lufi/Controller/Mail.pm:73
 msgid "The email body can't be empty."
 msgstr "Le corps du mail ne peut être vide."
 
-#: lib/Lufi/Controller/Mail.pm:42
+#: lib/Lufi/Controller/Mail.pm:72
 msgid "The email subject can't be empty."
 msgstr "Le sujet du mail ne peut être vide."
 
@@ -404,7 +408,7 @@ msgid "The files uploaded on a Lufi instance are encrypted before the upload to 
 msgstr "Les fichiers envoyés sur une instance de Lufi sont chiffrés avant l’envoi au serveur : l’administrateur du serveur ne peut pas voir le contenu de vos fichiers."
 
 #. (join(', ', @bad)
-#: lib/Lufi/Controller/Mail.pm:38
+#: lib/Lufi/Controller/Mail.pm:68
 msgid "The following email addresses are not valid: %1"
 msgstr "Les adresses mail suivantes ne sont pas valides : %1"
 
@@ -412,7 +416,7 @@ msgstr "Les adresses mail suivantes ne sont pas valides : %1"
 msgid "The link(s) has been copied to your clipboard"
 msgstr "Le(s) lien(s) a/ont été copié dans votre presse-papier"
 
-#: lib/Lufi/Controller/Mail.pm:66
+#: lib/Lufi/Controller/Mail.pm:97
 msgid "The mail has been sent."
 msgstr "Le mail a été envoyé."
 
@@ -479,6 +483,10 @@ msgstr "Qui a écrit ce logiciel ?"
 msgid "You can see the list of your files by clicking on the \"My files\" link at the top right of this page."
 msgstr "Vous pouvez voir la liste de vos fichiers en cliquant sur le lien « Mes fichiers » en haut à droite de cette page."
 
+#: lib/Lufi/Controller/Mail.pm:42
+msgid "You can't add URLs that are not related to this instance."
+msgstr "Vous ne pouvez pas ajouter d’URL non relatives à cette instance."
+
 #: themes/default/templates/about.html.ep:8
 msgid "You don't need to register yourself to upload files but be aware that, for legal reasons, your IP address will be stored when you send a file. Don't panic, this is normally the case for all sites on which you send files."
 msgstr "Vous n’avez pas besoin de vous enregistrer pour envoyer des fichiers mais notez que, pour des raisons légales, votre adresse IP sera enregistrée quand vous envoyez un fichier. Ne paniquez pas, c’est normalement le cas pour tous les sites où vous envoyez des fichiers."
@@ -499,7 +507,7 @@ msgstr "Vous essayez de quitter la page. L’envoi sera annulé. Êtes-vous sûr
 msgid "You have been successfully logged out."
 msgstr "Vous avez été déconnecté·e avec succès."
 
-#: lib/Lufi/Controller/Mail.pm:41
+#: lib/Lufi/Controller/Mail.pm:71
 msgid "You must give email addresses."
 msgstr "Vous devez envoyer des adresses mail."
 
diff --git a/themes/default/lib/Lufi/I18N/it.po b/themes/default/lib/Lufi/I18N/it.po
index f2e8ded..0d6245a 100644
--- a/themes/default/lib/Lufi/I18N/it.po
+++ b/themes/default/lib/Lufi/I18N/it.po
@@ -55,6 +55,10 @@ msgstr "A proposito"
 msgid "Add a password to file(s)"
 msgstr ""
 
+#: themes/default/templates/mail.html.ep:16
+msgid "Adding URLs not related to this Lufi instance to the mail body or subject is prohibited."
+msgstr ""
+
 #: themes/default/templates/about.html.ep:18
 msgid "As Lufi is a free software licensed under of the terms of the <a href=\"https://gnu.org/licenses/agpl.html\" class=\"classic\">AGPLv3</a>, you can install it on you own server. Have a look on the <a href=\"https://framagit.org/luc/lufi/wikis/home\" class=\"classic\">Wiki</a> for the procedure."
 msgstr "Poiché Lufi è un software libero soggetto ai termini della licenza <a href=\"https://gnu.org/licenses/agpl.html\" class=\"classic\">AGPLv3</a>, potete installarlo sul vostro  server. Si consulti <a href=\"https://framagit.org/luc/lufi/wikis/home\" class=\"classic\">Wiki</a> per vedere la procedura."
@@ -68,7 +72,7 @@ msgstr "Recupero della porzione del file XX1 su %1"
 msgid "Back to homepage"
 msgstr "Ritorna all'homepage"
 
-#: lib/Lufi/Controller/Mail.pm:21
+#: lib/Lufi/Controller/Mail.pm:25
 msgid "Bad CSRF token!"
 msgstr "Token CSRF errato!"
 
@@ -88,7 +92,7 @@ msgstr "Click per aprire il file browser"
 msgid "Close"
 msgstr "Chiudi"
 
-#: themes/default/templates/mail.html.ep:22
+#: themes/default/templates/mail.html.ep:23
 msgid "Comma-separated email addresses"
 msgstr "Indirizzi email separati da virgole"
 
@@ -152,15 +156,15 @@ msgstr "Trascinare e lasciare il file nell'are prevista o selezionare i file nel
 msgid "Drop files here"
 msgstr "Lasciare i file qui"
 
-#: themes/default/templates/mail.html.ep:38
+#: themes/default/templates/mail.html.ep:39
 msgid "Email body"
 msgstr "Corpo dell'email"
 
-#: themes/default/templates/mail.html.ep:30
+#: themes/default/templates/mail.html.ep:31
 msgid "Email subject"
 msgstr "Oggetto dell'email"
 
-#: themes/default/templates/mail.html.ep:24 themes/default/templates/mail.html.ep:26
+#: themes/default/templates/mail.html.ep:25 themes/default/templates/mail.html.ep:27
 msgid "Emails"
 msgstr "Email"
 
@@ -204,10 +208,6 @@ msgstr "Nome del file"
 msgid "Files deleted at first download"
 msgstr ""
 
-#: themes/default/templates/mail.html.ep:46
-msgid "Free field"
-msgstr ""
-
 #: themes/default/templates/partial/render.js.ep:8
 msgid "Get the file"
 msgstr "Ottenere il file"
@@ -220,7 +220,7 @@ msgstr "Ottenere il codice sorgente su <a href=\"https://framagit.org/luc/lufi\"
 msgid "Hello,\\n\\nHere's some files I want to share with you:\\n"
 msgstr "Buongiorno,\\n\\necco qualche file che vorrei condividere con te:\\n"
 
-#: themes/default/templates/mail.html.ep:34
+#: themes/default/templates/mail.html.ep:35
 msgid "Here's some files"
 msgstr "Ecco qualche file"
 
@@ -350,11 +350,11 @@ msgstr ""
 msgid "Send all links by email"
 msgstr "Inviare tutti i link tramite email"
 
-#: themes/default/templates/mail.html.ep:53
+#: themes/default/templates/mail.html.ep:46
 msgid "Send with this server"
 msgstr "Inviare tramite questo server"
 
-#: themes/default/templates/mail.html.ep:54
+#: themes/default/templates/mail.html.ep:47
 msgid "Send with your own mail software"
 msgstr "Inviare tramite il vostro programma di posta"
 
@@ -387,15 +387,19 @@ msgstr "L'amministratore pu vedere solo il nome del file, la sua dimensione e il
 msgid "The administrator can only see the file's name, its size and its mimetype (what kind of file it is: video, text, etc.)."
 msgstr ""
 
+#: lib/Lufi/Controller/Mail.pm:53
+msgid "The body of the mail must contain at least one URL pointing to a file hosted on this instance."
+msgstr ""
+
 #: themes/default/templates/partial/files.js.ep:11
 msgid "The data has been successfully imported."
 msgstr "I dati sono stati importati correttamente."
 
-#: lib/Lufi/Controller/Mail.pm:43
+#: lib/Lufi/Controller/Mail.pm:73
 msgid "The email body can't be empty."
 msgstr "Il corpo dell'email non può essere vuoto."
 
-#: lib/Lufi/Controller/Mail.pm:42
+#: lib/Lufi/Controller/Mail.pm:72
 msgid "The email subject can't be empty."
 msgstr "Il soggetto dell'email non può essere vuoto."
 
@@ -408,7 +412,7 @@ msgid "The files uploaded on a Lufi instance are encrypted before the upload to 
 msgstr "I file inviati su un istanza di Lufi sono cifrati prima dell'invio al server: l'amministratore del server non può vedere il contenuto dei vostri file."
 
 #. (join(', ', @bad)
-#: lib/Lufi/Controller/Mail.pm:38
+#: lib/Lufi/Controller/Mail.pm:68
 msgid "The following email addresses are not valid: %1"
 msgstr "I seguenti indirizzi email non sono validi: %1"
 
@@ -416,7 +420,7 @@ msgstr "I seguenti indirizzi email non sono validi: %1"
 msgid "The link(s) has been copied to your clipboard"
 msgstr "I link sono stati copiati negli appunti"
 
-#: lib/Lufi/Controller/Mail.pm:66
+#: lib/Lufi/Controller/Mail.pm:97
 msgid "The mail has been sent."
 msgstr "Email inviata."
 
@@ -483,6 +487,10 @@ msgstr "Chi ha scritto questo software?"
 msgid "You can see the list of your files by clicking on the \"My files\" link at the top right of this page."
 msgstr "Puoi consultare la lista dei vostri file cliccando sul link « I miei file » in alto a destra in questa pagina."
 
+#: lib/Lufi/Controller/Mail.pm:42
+msgid "You can't add URLs that are not related to this instance."
+msgstr ""
+
 #: themes/default/templates/about.html.ep:8
 msgid "You don't need to register yourself to upload files but be aware that, for legal reasons, your IP address will be stored when you send a file. Don't panic, this is normally the case for all sites on which you send files."
 msgstr "Non hai bisogno di registrarti per inviare i file ma devi essere consapevole che, per motivi legali, il tuo indirizzo IP sarà registrato quando invierai un file. Non ti preoccupare, avviene in tutti i siti su cui invii dei file."
@@ -503,7 +511,7 @@ msgstr "Hai cercato di uscire da questa pagina. L'invio sarà cancellato. Sei si
 msgid "You have been successfully logged out."
 msgstr "Logout avvenuto con successo."
 
-#: lib/Lufi/Controller/Mail.pm:41
+#: lib/Lufi/Controller/Mail.pm:71
 msgid "You must give email addresses."
 msgstr "Devi fornire gli indirizzi email."
 
diff --git a/themes/default/lib/Lufi/I18N/nl.po b/themes/default/lib/Lufi/I18N/nl.po
index 3440f65..200dc9c 100644
--- a/themes/default/lib/Lufi/I18N/nl.po
+++ b/themes/default/lib/Lufi/I18N/nl.po
@@ -42,6 +42,10 @@ msgstr "Over"
 msgid "Add a password to file(s)"
 msgstr ""
 
+#: themes/default/templates/mail.html.ep:16
+msgid "Adding URLs not related to this Lufi instance to the mail body or subject is prohibited."
+msgstr ""
+
 #: themes/default/templates/about.html.ep:18
 msgid "As Lufi is a free software licensed under of the terms of the <a href=\"https://gnu.org/licenses/agpl.html\" class=\"classic\">AGPLv3</a>, you can install it on you own server. Have a look on the <a href=\"https://framagit.org/luc/lufi/wikis/home\" class=\"classic\">Wiki</a> for the procedure."
 msgstr "Aangezien Lufi een gratis software id die gelicentieerd staat onder de voorwaarden van <a href=\"https://gnu.org/licenses/agpl.html\" class=\"classic\">AGPLv3</a>, kan je het installeren op je eigen server. Bekijk <a href=\"https://framagit.org/luc/lufi/wikis/home\" class=\"classic\">Wiki</a> voor de procedure."
@@ -55,7 +59,7 @@ msgstr "Deel XX1 van %1 wordt opgehaald"
 msgid "Back to homepage"
 msgstr "Terug naar home"
 
-#: lib/Lufi/Controller/Mail.pm:21
+#: lib/Lufi/Controller/Mail.pm:25
 msgid "Bad CSRF token!"
 msgstr "Verkeerde CSRF token!"
 
@@ -75,7 +79,7 @@ msgstr "Klik voor bestandbrowser"
 msgid "Close"
 msgstr "Sluiten"
 
-#: themes/default/templates/mail.html.ep:22
+#: themes/default/templates/mail.html.ep:23
 msgid "Comma-separated email addresses"
 msgstr "Komma gescheiden email adressen"
 
@@ -139,15 +143,15 @@ msgstr "Drag and drop bestanden in de daarvoor bestemde locatie of gebruik de tr
 msgid "Drop files here"
 msgstr "Sleep bestand(en) naar dit venster"
 
-#: themes/default/templates/mail.html.ep:38
+#: themes/default/templates/mail.html.ep:39
 msgid "Email body"
 msgstr "Email inhoud"
 
-#: themes/default/templates/mail.html.ep:30
+#: themes/default/templates/mail.html.ep:31
 msgid "Email subject"
 msgstr "Onderwerp"
 
-#: themes/default/templates/mail.html.ep:24 themes/default/templates/mail.html.ep:26
+#: themes/default/templates/mail.html.ep:25 themes/default/templates/mail.html.ep:27
 msgid "Emails"
 msgstr "Emails"
 
@@ -191,10 +195,6 @@ msgstr "Bestandsnaam"
 msgid "Files deleted at first download"
 msgstr ""
 
-#: themes/default/templates/mail.html.ep:46
-msgid "Free field"
-msgstr ""
-
 #: themes/default/templates/partial/render.js.ep:8
 msgid "Get the file"
 msgstr "Download bestand"
@@ -207,7 +207,7 @@ msgstr "Krijg de broncode op <a href=\"https://framagit.org/luc/lufi\" class=\"c
 msgid "Hello,\\n\\nHere's some files I want to share with you:\\n"
 msgstr "Hallo,\\n\\nHier zijn enkele bestanden die ik met je wil delen:\\n\\n"
 
-#: themes/default/templates/mail.html.ep:34
+#: themes/default/templates/mail.html.ep:35
 msgid "Here's some files"
 msgstr "Hier zijn enkele bestanden"
 
@@ -337,11 +337,11 @@ msgstr "Rode rijen betekenen dat deze bestanden verlopen en verwijderd zijn."
 msgid "Send all links by email"
 msgstr "Verstuur alle links via mail"
 
-#: themes/default/templates/mail.html.ep:53
+#: themes/default/templates/mail.html.ep:46
 msgid "Send with this server"
 msgstr "Verstuur via deze server"
 
-#: themes/default/templates/mail.html.ep:54
+#: themes/default/templates/mail.html.ep:47
 msgid "Send with your own mail software"
 msgstr "Verstuur via eigen mail software"
 
@@ -370,15 +370,19 @@ msgstr "SOrry, uploaden is uitgeschakeld."
 msgid "The administrator can only see the file's name, its size and its mimetype (what kind of file it is: video, text, etc.)."
 msgstr "Beheerders zien alleen bestandsnamen, grootte en mimetype (wat voor soort bestand het is: video, tekst etc.)."
 
+#: lib/Lufi/Controller/Mail.pm:53
+msgid "The body of the mail must contain at least one URL pointing to a file hosted on this instance."
+msgstr ""
+
 #: themes/default/templates/partial/files.js.ep:11
 msgid "The data has been successfully imported."
 msgstr "Data is succesvol geimporteerd."
 
-#: lib/Lufi/Controller/Mail.pm:43
+#: lib/Lufi/Controller/Mail.pm:73
 msgid "The email body can't be empty."
 msgstr "Mail inhoud kan niet leeg zijn."
 
-#: lib/Lufi/Controller/Mail.pm:42
+#: lib/Lufi/Controller/Mail.pm:72
 msgid "The email subject can't be empty."
 msgstr "Onderwerp kan niet leeg zijn."
 
@@ -391,7 +395,7 @@ msgid "The files uploaded on a Lufi instance are encrypted before the upload to 
 msgstr "Bestanden die geupload zijn naar Lufi worden voor de upload versleuteld: beheerders van de server kunnen de inhoud van het bestand niet zien."
 
 #. (join(', ', @bad)
-#: lib/Lufi/Controller/Mail.pm:38
+#: lib/Lufi/Controller/Mail.pm:68
 msgid "The following email addresses are not valid: %1"
 msgstr "Volgende email adressen zijn niet geldig: %1"
 
@@ -399,7 +403,7 @@ msgstr "Volgende email adressen zijn niet geldig: %1"
 msgid "The link(s) has been copied to your clipboard"
 msgstr "De link is gekopieerd naar je klembord"
 
-#: lib/Lufi/Controller/Mail.pm:66
+#: lib/Lufi/Controller/Mail.pm:97
 msgid "The mail has been sent."
 msgstr "Email is verzonden."
 
@@ -466,6 +470,10 @@ msgstr "Wie heeft deze software geschreven?"
 msgid "You can see the list of your files by clicking on the \"My files\" link at the top right of this page."
 msgstr "Je kan een lijst van je eigen bestanden zien door op \"Mijn bestanden\" link rechts boven te klikken."
 
+#: lib/Lufi/Controller/Mail.pm:42
+msgid "You can't add URLs that are not related to this instance."
+msgstr ""
+
 #: themes/default/templates/about.html.ep:8
 msgid "You don't need to register yourself to upload files but be aware that, for legal reasons, your IP address will be stored when you send a file. Don't panic, this is normally the case for all sites on which you send files."
 msgstr "U hoeft zich niet te registreren om bestanden te uploaden, maar wees ervan bewust dat uw IP-adres om juridische redenen zal worden opgeslagen wanneer u een bestand verzendt. Geen paniek, dit is normaal gesproken het geval voor alle sites waarnaar u bestanden verzendt."
@@ -486,7 +494,7 @@ msgstr "Je verlaat deze pagina. Upload zal geannuleerd worden. Weet je het zeker
 msgid "You have been successfully logged out."
 msgstr "Je bent succesvol uitgelogd."
 
-#: lib/Lufi/Controller/Mail.pm:41
+#: lib/Lufi/Controller/Mail.pm:71
 msgid "You must give email addresses."
 msgstr "Je moet een mail adres opgeven."
 
diff --git a/themes/default/lib/Lufi/I18N/oc.po b/themes/default/lib/Lufi/I18N/oc.po
index 6a2e71e..491dddb 100644
--- a/themes/default/lib/Lufi/I18N/oc.po
+++ b/themes/default/lib/Lufi/I18N/oc.po
@@ -55,6 +55,10 @@ msgstr "A prepaus"
 msgid "Add a password to file(s)"
 msgstr "Apondre un senhal al(s) fichièr(s)"
 
+#: themes/default/templates/mail.html.ep:16
+msgid "Adding URLs not related to this Lufi instance to the mail body or subject is prohibited."
+msgstr ""
+
 #: themes/default/templates/about.html.ep:18
 msgid "As Lufi is a free software licensed under of the terms of the <a href=\"https://gnu.org/licenses/agpl.html\" class=\"classic\">AGPLv3</a>, you can install it on you own server. Have a look on the <a href=\"https://framagit.org/luc/lufi/wikis/home\" class=\"classic\">Wiki</a> for the procedure."
 msgstr "Ja que Lufi es un logicial liure somés als tèrmes de la licéncia <a href=\"https://gnu.org/licenses/agpl.html\" class=\"classic\">AGPLv3</a>, podètz l’installar sus vòstre pròpri servidor. Mercés de consultar lo <a href=\"https://framagit.org/luc/lufi/wikis/home\" class=\"classic\">Wiki</a> per veire la procedura."
@@ -68,7 +72,7 @@ msgstr "Demanda del tròç XX1 sus %1 del fichièr"
 msgid "Back to homepage"
 msgstr "Retorn a la pagina d’acuèlh"
 
-#: lib/Lufi/Controller/Mail.pm:21
+#: lib/Lufi/Controller/Mail.pm:25
 msgid "Bad CSRF token!"
 msgstr "Marrit geton CSRF !"
 
@@ -88,7 +92,7 @@ msgstr "Clicatz per dobrir lo navigador de fichièr"
 msgid "Close"
 msgstr "Tampar"
 
-#: themes/default/templates/mail.html.ep:22
+#: themes/default/templates/mail.html.ep:23
 msgid "Comma-separated email addresses"
 msgstr "Adreças de corrièl separadas per de virgulas"
 
@@ -152,15 +156,15 @@ msgstr "Fasètz lisar de fichièrs dins la zòna prevista per aquò far o selecc
 msgid "Drop files here"
 msgstr "Lisatz vòstres fichièrs aquí"
 
-#: themes/default/templates/mail.html.ep:38
+#: themes/default/templates/mail.html.ep:39
 msgid "Email body"
 msgstr "Còs del corrièl"
 
-#: themes/default/templates/mail.html.ep:30
+#: themes/default/templates/mail.html.ep:31
 msgid "Email subject"
 msgstr "Subjècte del corrièl"
 
-#: themes/default/templates/mail.html.ep:24 themes/default/templates/mail.html.ep:26
+#: themes/default/templates/mail.html.ep:25 themes/default/templates/mail.html.ep:27
 msgid "Emails"
 msgstr "Corrièl"
 
@@ -204,10 +208,6 @@ msgstr "Nom del fichièr"
 msgid "Files deleted at first download"
 msgstr "Fichièr suprimit al primièr telecargament"
 
-#: themes/default/templates/mail.html.ep:46
-msgid "Free field"
-msgstr ""
-
 #: themes/default/templates/partial/render.js.ep:8
 msgid "Get the file"
 msgstr "Recuperar lo fichièr"
@@ -220,7 +220,7 @@ msgstr "Recuperatz lo còdi font sul <a href=\"https://framagit.org/luc/lufi\" c
 msgid "Hello,\\n\\nHere's some files I want to share with you:\\n"
 msgstr "Bonjorn,\\n\\nVaquí qualques fichièrs que desiri partejar amb tu :\\n"
 
-#: themes/default/templates/mail.html.ep:34
+#: themes/default/templates/mail.html.ep:35
 msgid "Here's some files"
 msgstr "Vaquí qualques fichièrs"
 
@@ -350,11 +350,11 @@ msgstr "Las linhas en roge indican que lo fichièr a expirat e es pas mai dispon
 msgid "Send all links by email"
 msgstr "Mandar totes los ligams per corrièl"
 
-#: themes/default/templates/mail.html.ep:53
+#: themes/default/templates/mail.html.ep:46
 msgid "Send with this server"
 msgstr "Mandar amb aqueste servidor"
 
-#: themes/default/templates/mail.html.ep:54
+#: themes/default/templates/mail.html.ep:47
 msgid "Send with your own mail software"
 msgstr "Mandar amb vòstre pròpri logicial de corrièl"
 
@@ -387,15 +387,19 @@ msgstr "O planhèm, la foncion per mandar de fichièr es desactivada."
 msgid "The administrator can only see the file's name, its size and its mimetype (what kind of file it is: video, text, etc.)."
 msgstr "L’administrator pòt pas que veire lo nom del fichièr, sa talha e son mimetype (Quina mena de fichièr es : vidèo, tèxte, etc.)."
 
+#: lib/Lufi/Controller/Mail.pm:53
+msgid "The body of the mail must contain at least one URL pointing to a file hosted on this instance."
+msgstr ""
+
 #: themes/default/templates/partial/files.js.ep:11
 msgid "The data has been successfully imported."
 msgstr "Las donadas son ben estadas importadas."
 
-#: lib/Lufi/Controller/Mail.pm:43
+#: lib/Lufi/Controller/Mail.pm:73
 msgid "The email body can't be empty."
 msgstr "Lo contengut del corrièl pòt pas èsser void."
 
-#: lib/Lufi/Controller/Mail.pm:42
+#: lib/Lufi/Controller/Mail.pm:72
 msgid "The email subject can't be empty."
 msgstr "Lo sujècte del corrièl pòt pas èsser void."
 
@@ -408,7 +412,7 @@ msgid "The files uploaded on a Lufi instance are encrypted before the upload to 
 msgstr "Los fichièrs mandats amb una instància Lufi son chifrats abans la mandadís al servidor : l’administrator del servidor pòt pas veire lo contengut dels fichièrs."
 
 #. (join(', ', @bad)
-#: lib/Lufi/Controller/Mail.pm:38
+#: lib/Lufi/Controller/Mail.pm:68
 msgid "The following email addresses are not valid: %1"
 msgstr "Las adreças de corrièl seguentas son pas validas : %1"
 
@@ -416,7 +420,7 @@ msgstr "Las adreças de corrièl seguentas son pas validas : %1"
 msgid "The link(s) has been copied to your clipboard"
 msgstr "Lo(s) ligam(s) es/son estat(s) copiat(s) dins vòstre quicha-papièrs"
 
-#: lib/Lufi/Controller/Mail.pm:66
+#: lib/Lufi/Controller/Mail.pm:97
 msgid "The mail has been sent."
 msgstr "Lo corrièl es estat mandat."
 
@@ -483,6 +487,10 @@ msgstr "Qual escriguèt aqueste logicial ?"
 msgid "You can see the list of your files by clicking on the \"My files\" link at the top right of this page."
 msgstr "Podètz veire la lista de vòstres fichièrs en clicant sul ligam « Mos fichièrs » amont a man drecha d’aquesta pagina."
 
+#: lib/Lufi/Controller/Mail.pm:42
+msgid "You can't add URLs that are not related to this instance."
+msgstr ""
+
 #: themes/default/templates/about.html.ep:8
 msgid "You don't need to register yourself to upload files but be aware that, for legal reasons, your IP address will be stored when you send a file. Don't panic, this is normally the case for all sites on which you send files."
 msgstr "Avètz pas besonh de vos enregistrar per mandar de fichièrs mas notatz que, per de rasons legalas, vòstra adreça IP serà enregistrada quand mandatz un fichièr. Paniquetz pas, es normalament lo cas per totes los sites ont mandatz de fichièrs."
@@ -503,7 +511,7 @@ msgstr "Ensajatz de partir de la pagina. Lo mandadís serà anullat. Sètz segur
 msgid "You have been successfully logged out."
 msgstr "Sètz ben estat desconnectat."
 
-#: lib/Lufi/Controller/Mail.pm:41
+#: lib/Lufi/Controller/Mail.pm:71
 msgid "You must give email addresses."
 msgstr "Vos cal donar d’adreças."
 
diff --git a/themes/default/lib/Lufi/I18N/pt.po b/themes/default/lib/Lufi/I18N/pt.po
index 650b8eb..8f4dccd 100644
--- a/themes/default/lib/Lufi/I18N/pt.po
+++ b/themes/default/lib/Lufi/I18N/pt.po
@@ -56,6 +56,10 @@ msgstr "Sobre"
 msgid "Add a password to file(s)"
 msgstr ""
 
+#: themes/default/templates/mail.html.ep:16
+msgid "Adding URLs not related to this Lufi instance to the mail body or subject is prohibited."
+msgstr ""
+
 #: themes/default/templates/about.html.ep:18
 msgid "As Lufi is a free software licensed under of the terms of the <a href=\"https://gnu.org/licenses/agpl.html\" class=\"classic\">AGPLv3</a>, you can install it on you own server. Have a look on the <a href=\"https://framagit.org/luc/lufi/wikis/home\" class=\"classic\">Wiki</a> for the procedure."
 msgstr "Como Lufi é um programa livre sob os termos da licença <a href=\"https://gnu.org/licenses/agpl.html\" class=\"classic\">AGPLv3</a>, pode instalar-lo no seu prórpio servidor. Para saber mais clique aqui <a href=\"https://framagit.org/luc/lufi/wikis/home\" class=\"classic\">Wiki</a> para ver o procedimento."
@@ -69,7 +73,7 @@ msgstr "Pedido de recuperação de um fragmento do ficheiro XX1 de %1"
 msgid "Back to homepage"
 msgstr "Voltar à página inicial"
 
-#: lib/Lufi/Controller/Mail.pm:21
+#: lib/Lufi/Controller/Mail.pm:25
 msgid "Bad CSRF token!"
 msgstr "Símbolo errado CSRF !"
 
@@ -89,7 +93,7 @@ msgstr "Clique para abrir o navegador de ficheiros"
 msgid "Close"
 msgstr "Fechar"
 
-#: themes/default/templates/mail.html.ep:22
+#: themes/default/templates/mail.html.ep:23
 msgid "Comma-separated email addresses"
 msgstr "Os e-mails devem ser separados por vírgulas"
 
@@ -157,15 +161,15 @@ msgstr ""
 msgid "Drop files here (max. 4 Gb/file)"
 msgstr "Deslize os ficheiros aqui (max. 4 Gb/ficheiro)"
 
-#: themes/default/templates/mail.html.ep:38
+#: themes/default/templates/mail.html.ep:39
 msgid "Email body"
 msgstr "Conteúdo do e-mail"
 
-#: themes/default/templates/mail.html.ep:30
+#: themes/default/templates/mail.html.ep:31
 msgid "Email subject"
 msgstr "Assunto do e-mail"
 
-#: themes/default/templates/mail.html.ep:24 themes/default/templates/mail.html.ep:26
+#: themes/default/templates/mail.html.ep:25 themes/default/templates/mail.html.ep:27
 msgid "Emails"
 msgstr "E-mails"
 
@@ -209,10 +213,6 @@ msgstr "Nome do ficheiro"
 msgid "Files deleted at first download"
 msgstr ""
 
-#: themes/default/templates/mail.html.ep:46
-msgid "Free field"
-msgstr ""
-
 #: themes/default/templates/partial/render.js.ep:8
 msgid "Get the file"
 msgstr "Recuperar o ficheiro"
@@ -225,7 +225,7 @@ msgstr "Recupere o código-fonte no <a href=\"https://framagit.org/luc/lufi\" cl
 msgid "Hello,\\n\\nHere's some files I want to share with you:\\n"
 msgstr "Olá,\\n\\nAqui estão alguns ficheiros que gostaria de partilhar contigo:\\n"
 
-#: themes/default/templates/mail.html.ep:34
+#: themes/default/templates/mail.html.ep:35
 msgid "Here's some files"
 msgstr "Aqui estão alguns ficheiros"
 
@@ -355,11 +355,11 @@ msgstr "As linhas a vermelho indicam que o ficheiro expirou e já não está dis
 msgid "Send all links by email"
 msgstr "Enviar todos os links por e-mail"
 
-#: themes/default/templates/mail.html.ep:53
+#: themes/default/templates/mail.html.ep:46
 msgid "Send with this server"
 msgstr "Enviar com este servidor"
 
-#: themes/default/templates/mail.html.ep:54
+#: themes/default/templates/mail.html.ep:47
 msgid "Send with your own mail software"
 msgstr "Enviar com o seu e-mail pessoal"
 
@@ -388,15 +388,19 @@ msgstr "Desculpe, o envio do ficheiro está desativado."
 msgid "The administrator can only see the file's name, its size and its mimetype (what kind of file it is: video, text, etc.)."
 msgstr "O administrador pode apenas ver o nome do ficheiro, o seu tamanho e o tipo de mime (o tipo de ficheiro: texto, vídeo, etc.)."
 
+#: lib/Lufi/Controller/Mail.pm:53
+msgid "The body of the mail must contain at least one URL pointing to a file hosted on this instance."
+msgstr ""
+
 #: themes/default/templates/partial/files.js.ep:11
 msgid "The data has been successfully imported."
 msgstr "Os dados foram importados com sucesso."
 
-#: lib/Lufi/Controller/Mail.pm:43
+#: lib/Lufi/Controller/Mail.pm:73
 msgid "The email body can't be empty."
 msgstr "A mensagem do e-mail não pode estar vazia."
 
-#: lib/Lufi/Controller/Mail.pm:42
+#: lib/Lufi/Controller/Mail.pm:72
 msgid "The email subject can't be empty."
 msgstr "O assunto do e-mail não pode estar vazio."
 
@@ -409,7 +413,7 @@ msgid "The files uploaded on a Lufi instance are encrypted before the upload to 
 msgstr "Os ficheiros enviados no Lufi são codificados antes de serem enviados ao servidor: o administrador do servidor não pode ver o conteúdo dos ficheiros."
 
 #. (join(', ', @bad)
-#: lib/Lufi/Controller/Mail.pm:38
+#: lib/Lufi/Controller/Mail.pm:68
 msgid "The following email addresses are not valid: %1"
 msgstr "Os e-mails seguintes não são válidos: %1"
 
@@ -417,7 +421,7 @@ msgstr "Os e-mails seguintes não são válidos: %1"
 msgid "The link(s) has been copied to your clipboard"
 msgstr "O(s) link(s) foi/foram copiados para a área de transferência"
 
-#: lib/Lufi/Controller/Mail.pm:66
+#: lib/Lufi/Controller/Mail.pm:97
 msgid "The mail has been sent."
 msgstr "O e-mail foi enviado."
 
@@ -488,6 +492,10 @@ msgstr ""
 msgid "You can see the list of your files by clicking on the \"My files\" link at the top right of this page."
 msgstr "Pode ver a lista dos seus ficheiros clicando no link « Meus ficheiros » em cima da página à direita."
 
+#: lib/Lufi/Controller/Mail.pm:42
+msgid "You can't add URLs that are not related to this instance."
+msgstr ""
+
 #: themes/default/templates/about.html.ep:8
 msgid "You don't need to register yourself to upload files but be aware that, for legal reasons, your IP address will be stored when you send a file. Don't panic, this is normally the case for all sites on which you send files."
 msgstr "Não precisa registar-se para enviar ficheiros mas saiba que, por razões legais, o seu endereço IP ficará registrado quando envia um ficheiro. Não entre em pânico, é algo comum a todos os sites onde envia ficheiros."
@@ -508,7 +516,7 @@ msgstr "Está a tentar sair da página. O envio será anulado. Tem a certeza?"
 msgid "You have been successfully logged out."
 msgstr "Foi desconectado com sucesso."
 
-#: lib/Lufi/Controller/Mail.pm:41
+#: lib/Lufi/Controller/Mail.pm:71
 msgid "You must give email addresses."
 msgstr "Deve escrever os e-mails."
 
diff --git a/themes/default/templates/mail.html.ep b/themes/default/templates/mail.html.ep
index d72d839..4d47684 100644
--- a/themes/default/templates/mail.html.ep
+++ b/themes/default/templates/mail.html.ep
@@ -4,7 +4,7 @@
     <div class="col s12">
         <div class="card pink">
             <div class="card-content white-text">
-                <strong><%= stash('msg')%></strong>
+                <strong><%== stash('msg')%></strong>
             </div>
         </div>
     </div>
@@ -13,6 +13,7 @@
         <div class="card cyan">
             <div class="card-content white-text">
                 <p><%= l('If you send the mail from this server, the links will be sent to the server, which may lower your privacy protection.') %></p>
+                <p><%= l('Adding URLs not related to this Lufi instance to the mail body or subject is prohibited.') %></p>
             </div>
         </div>
     </div>