.

generic/views.py

@@ -20,6 +20,9 @@ from django.http import HttpResponseRedirect, HttpResponse
 
 from django.contrib.auth.mixins import LoginRequiredMixin, UserPassesTestMixin
 
+from django.core.exceptions import ValidationError
+from django.core.validators import validate_email
+
 
 from django.utils.decorators import method_decorator
 
@@ -585,6 +588,15 @@ class ExamViews(View, LoginRequiredMixin):
                 raise PermissionDenied
 
 
+        additional_email = request.GET.get("additional_email", "")
+
+        # check addition email is valid
+        if additional_email:
+            try:
+                validate_email(additional_email)
+            except ValidationError:
+                return JsonResponse("Invalid additional email")
+
         # We only need to send emails to those who have scores
         # (who should be in exam.user_scores)
         users = [i[2:] for i in exam.user_scores if i.startswith("u/")]
@@ -594,7 +606,10 @@ class ExamViews(View, LoginRequiredMixin):
         email_results = {}
         for u in users:
             user = User.objects.get(pk=u)
-            email_results[user.username] = exam.email_user_results(user)
+            if additional_email:
+                email_results[user.username] = exam.email_user_results(user, additional_emails=[additional_email])
+            else:
+                email_results[user.username] = exam.email_user_results(user)
 
             user_exam = exam.get_or_create_cid_user_exam(user_user=user)
             user_exam.results_emailed_status = json.dumps(email_results[user.username]) + f" {time}"