Vulnerability in EPiServer.Forms
I have extended the built-in SendEmailAfterSubmissionActor from EPiServer Forms in order to wrap the contents of the e-mail from the "Message" field from the "Send email after form submission" pop-up in EPiServer with a branded e-mail template we have designed for our client. This same e-mail template is a HTML file we also use for custom e-mails we send from the website.
After doing some research I appear to have the entire class set up correctly now, but upon executing it the list of EmailTemplateActorModel instances which should represent each e-mail configured to send from within EPiServer is empty and therefore, a portion of our code is skipped by and the e-mail is sent regardless, sans custom e-mail template. Judging from all the examples I found online this shouldn't be the case. My class and the Run() method inside are being hit as proven when I run the website in Visual Studio's debug mode. But the Model object is always an empty list of EmailTemplateActorModel, causing the foreach to be skipped. Does anyone have any ideas as to what is going wrong here? I have included an excerpt below, somewhat trimmed for brevity:
public class CustomSendEmailAfterSubmissionActor : SendEmailAfterSubmissionActor
private static readonly ILogger Logger = LogManager.GetLogger();
public override object Run(object input)
var emailTemplate = EmailHelpers.GetEmailTemplate("template.html");
var emailList = Model as IEnumerable<EmailTemplateActorModel>; // This is always an empty list, even without casting
// ... removed irrelevant code here
foreach (EmailTemplateActorModel email in emailList)
email.Body = new XhtmlString(
catch (Exception ex)
Logger.Error($"Error while adding e-mail template to EPiServer Forms SendEmailAfterSubmissionActor", ex);
A quick update: I just discovered that somehow it appears my custom class has caused an extra "list" property type field to be added to the "Settings" tab of an instance of EPiServer Forms, above the existing one and without a label preceding it. See below:
After adding an entry to this property and testing the custom actor once more in debug mode, it appears that the Model object now in fact does contain one item in its list and it appears to be the entry I added to the top property list in my screenshot. So that is progress, although I'd rather replace the below one instead.
However, I am still not receiving an e-mail with my custom e-mail template being used, but just the 'plain' EPiServer Forms e-mail template (i.e. no body besides what is from the RTE in EPiServer). Am I still missing something in my custom actor?
A further update. I found this article on EPiServer World:
So I have adjusted my solution to attempt to hide the original e-mail template and only display my custom one, exactly as described in that article. However, I'm having poor luck with this. Either they are both displayed, or they are both hidden (once I apply the metadata.ShowForEdit = false to the original actor) despite adding an actor model extending from EmailTemplateActorModel and adding a dedicated EditorDescriptor for that one.
metadata.ShowForEdit = false
No fields at all:
If I comment out the metadata.ShowForEdit = false line, the odd screenshot below is the result (instead of either of the fields showing up):
What am I missing here? How can I hide one field while displaying the other?
Ok, final update in case anyone ever runs into this problem 😉
I forgot one thing when using the example I linked to above: the CustomSendEmailAfterSubmittionActor needed an override for the class variable PropertyType, telling which actor to use. This is what I added:
public override Type PropertyType => typeof(CustomEmailTemplateActor);
My CustomEmailTemplateActor class is nothing but a placeholder class (inheriting from ProperyGenericList<CustomEmailTemplateActorModel>) as instead of loading the template from an EPiServer block as in the example I linked to, I am loading in a static HTML file from disk and using that as a template to wrap around EPiServer Forms' original e-mail template. But if you don't add that placeholder class and both an EmailTemplateActorEditorDescriptor (to hide the original) and a CustomEmailTemplateActorEditorDescriptor (to tell which front-end kit to use for the property type), you can't get EPiServer to hide the original field and only show your custom field (at least, I couldn't).
I hope this thread is of use to someone in the future!