Hello JLexComments Support Team,
I have identified a reproducible issue in JLexComments related to email notifications when someone replies to a guest comment without an email address.
Steps to reproduce:
Configure JLexComments to allow guest comments without requiring an email address.
A guest submits a comment without providing an email address.
A registered user replies to that comment.
JLexComments creates a REPLY notification with an empty guest_remind_email.
The cron job index.php?option=com_jlexcomment&task=subscribe.mail attempts to send the notification and fails with HTTP 500.
Error message:
Invalid address: (to):
Code analysis:
1. Notification creation – missing email validation
File: administrator/components/com_jlexcomment/models/item.php
In the __alert_import() function, the component checks whether the reply author is the same person as the parent comment author, and whether a notification has already been generated for that recipient.
However, it does not check whether the recipient has a valid email address before creating the notification.
For guest comments, the following code is executed:
$data['guest_remind_name'] = $parent_uid->rep_name;
$data['guest_remind_email'] = $parent_uid->rep_email;
The notification is subsequently created using:
$this->_notification_import($data);
As a result, a REPLY notification can be created with an empty recipient email address.
2. Email delivery – missing recipient validation
File: components/com_jlexcomment/models/subscribe.php
In the mailq() function, the recipient address is used without validation:
$mailer->addRecipient($nof->rep_email, $nof->rep_name);
$mailer->Send();
When rep_email is empty, the mailer raises an invalid recipient address error, causing the cron request to terminate with HTTP 500.
3. Notification marked as sent before actual delivery
The same mailq() function updates the notification status to sent=1 before attempting to send the email.
Consequently, a notification may be marked as sent even when delivery fails. This can also make troubleshooting more difficult and potentially prevent failed notifications from being retried.
4. Additional observation regarding notification creation
The existing conditions in __alert_import() prevent certain duplicate or self-notifications, but do not verify whether an email notification can actually be delivered.
In my opinion, a guest comment without an email address should not generate an email notification for replies, since there is no valid recipient.
This should not affect the ability of guests to submit comments without providing an email address.
Example from my database:
Parent comment ID: 63904 — guest without email
Reply comment ID: 63905 — registered user
Notification ID: 194
Action type: REPLY
guest_remind_email: empty
sent: 1
Date: 2026-10-28
I also found 30 notifications with empty recipient addresses, dating from July through October 2026, all with action type REPLY.
Expected behavior and suggested fix:
I recommend addressing this issue at two levels:
During notification creation: Check whether the intended recipient has a valid email address. If no valid address is available, do not create an email notification for that recipient.
During email delivery: Validate the recipient address before calling addRecipient(). Invalid or empty addresses should be skipped without interrupting the processing of other notifications.
Delivery status handling: Avoid marking notifications as successfully sent before the email has been processed successfully.
These safeguards would prevent a single invalid notification from causing the entire cron job to fail.
I would prefer not to modify the component's PHP files locally, since these changes would be overwritten by future updates.
Could you please investigate this issue and include a permanent fix in an upcoming JLexComments release?
Thank you for your support!
I have identified a reproducible issue in JLexComments related to email notifications when someone replies to a guest comment without an email address.
Steps to reproduce:
Configure JLexComments to allow guest comments without requiring an email address.
A guest submits a comment without providing an email address.
A registered user replies to that comment.
JLexComments creates a REPLY notification with an empty guest_remind_email.
The cron job index.php?option=com_jlexcomment&task=subscribe.mail attempts to send the notification and fails with HTTP 500.
Error message:
Invalid address: (to):
Code analysis:
1. Notification creation – missing email validation
File: administrator/components/com_jlexcomment/models/item.php
In the __alert_import() function, the component checks whether the reply author is the same person as the parent comment author, and whether a notification has already been generated for that recipient.
However, it does not check whether the recipient has a valid email address before creating the notification.
For guest comments, the following code is executed:
$data['guest_remind_name'] = $parent_uid->rep_name;
$data['guest_remind_email'] = $parent_uid->rep_email;
The notification is subsequently created using:
$this->_notification_import($data);
As a result, a REPLY notification can be created with an empty recipient email address.
2. Email delivery – missing recipient validation
File: components/com_jlexcomment/models/subscribe.php
In the mailq() function, the recipient address is used without validation:
$mailer->addRecipient($nof->rep_email, $nof->rep_name);
$mailer->Send();
When rep_email is empty, the mailer raises an invalid recipient address error, causing the cron request to terminate with HTTP 500.
3. Notification marked as sent before actual delivery
The same mailq() function updates the notification status to sent=1 before attempting to send the email.
Consequently, a notification may be marked as sent even when delivery fails. This can also make troubleshooting more difficult and potentially prevent failed notifications from being retried.
4. Additional observation regarding notification creation
The existing conditions in __alert_import() prevent certain duplicate or self-notifications, but do not verify whether an email notification can actually be delivered.
In my opinion, a guest comment without an email address should not generate an email notification for replies, since there is no valid recipient.
This should not affect the ability of guests to submit comments without providing an email address.
Example from my database:
Parent comment ID: 63904 — guest without email
Reply comment ID: 63905 — registered user
Notification ID: 194
Action type: REPLY
guest_remind_email: empty
sent: 1
Date: 2026-10-28
I also found 30 notifications with empty recipient addresses, dating from July through October 2026, all with action type REPLY.
Expected behavior and suggested fix:
I recommend addressing this issue at two levels:
During notification creation: Check whether the intended recipient has a valid email address. If no valid address is available, do not create an email notification for that recipient.
During email delivery: Validate the recipient address before calling addRecipient(). Invalid or empty addresses should be skipped without interrupting the processing of other notifications.
Delivery status handling: Avoid marking notifications as successfully sent before the email has been processed successfully.
These safeguards would prevent a single invalid notification from causing the entire cron job to fail.
I would prefer not to modify the component's PHP files locally, since these changes would be overwritten by future updates.
Could you please investigate this issue and include a permanent fix in an upcoming JLexComments release?
Thank you for your support!