From 794b61b163f29ae9167424d463142b7a001aa2f1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Thu, 26 Mar 2026 08:14:45 +0100
Subject: [PATCH] Filter the MIME type of the additional documents in UBL
 allowed by the specification

Closes #14708
---
 modules/edocument_ubl/CHANGELOG               |  1 +
 modules/edocument_ubl/edocument.py            | 20 +++++++++++++++++++
 .../edocument_ubl/template/2/CreditNote.xml   |  2 +-
 modules/edocument_ubl/template/2/Invoice.xml  |  2 +-
 4 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/modules/edocument_ubl/CHANGELOG b/modules/edocument_ubl/CHANGELOG
index eafa21c685..f55ea67c83 100644
--- a/modules/edocument_ubl/CHANGELOG
+++ b/modules/edocument_ubl/CHANGELOG
@@ -1,3 +1,4 @@
+* Filter the MIME type of the additional documents allowed by the specification
 * Use VATEX as tax exemption reason code
 * Add support for Python 3.14
 * Remove support for Python 3.9
diff --git a/modules/edocument_ubl/edocument.py b/modules/edocument_ubl/edocument.py
index 221ac19d28..3d9beaaca2 100644
--- a/modules/edocument_ubl/edocument.py
+++ b/modules/edocument_ubl/edocument.py
@@ -119,6 +119,26 @@ class Invoice(Model):
         else:
             return '389'
 
+    def allowed_additional_documents(self, specification=None):
+        allowed_mimetypes = self._allowed_addition_document_mimetypes(
+            specification)
+        for document in self.additional_documents:
+            if (document.get('code') != '130'
+                    and allowed_mimetypes
+                    and document.get('mimetype', '') not in allowed_mimetypes):
+                continue
+            yield document
+
+    @classmethod
+    def _allowed_addition_document_mimetypes(cls, specification=None):
+        if specification and specification.startswith('peppol'):
+            return {'application/pdf', 'image/png', 'image/jpeg', 'text/csv',
+                'application/'
+                'vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+                'application/vnd.oasis.opendocument.spreadsheet'}
+        else:
+            return {}
+
     @property
     def additional_documents(self):
         pool = Pool()
diff --git a/modules/edocument_ubl/template/2/CreditNote.xml b/modules/edocument_ubl/template/2/CreditNote.xml
index 606c0deea4..bdf1a9a423 100644
--- a/modules/edocument_ubl/template/2/CreditNote.xml
+++ b/modules/edocument_ubl/template/2/CreditNote.xml
@@ -30,7 +30,7 @@ this repository contains the full copyright notices and license terms. -->
         <cbc:IssueDate>${origin_invoice.invoice_date}</cbc:IssueDate>
     </cac:InvoiceDocumentReference>
 </cac:BillingReference>
-<cac:AdditionalDocumentReference py:for="document in this.additional_documents">
+<cac:AdditionalDocumentReference py:for="document in this.allowed_additional_documents(specification)">
     <cbc:ID>${document['id']}</cbc:ID>
     <cbc:DocumentTypeCode py:if="document.get('code')">${document['code']}</cbc:DocumentTypeCode>
     <cbc:DocumentDescription py:if="document.get('description')">${document['description']}</cbc:DocumentDescription>
diff --git a/modules/edocument_ubl/template/2/Invoice.xml b/modules/edocument_ubl/template/2/Invoice.xml
index dea4fa5825..be9cc7ddba 100644
--- a/modules/edocument_ubl/template/2/Invoice.xml
+++ b/modules/edocument_ubl/template/2/Invoice.xml
@@ -30,7 +30,7 @@ this repository contains the full copyright notices and license terms. -->
         <cbc:IssueDate>${origin_invoice.invoice_date}</cbc:IssueDate>
     </cac:InvoiceDocumentReference>
 </cac:BillingReference>
-<cac:AdditionalDocumentReference py:for="document in this.additional_documents">
+<cac:AdditionalDocumentReference py:for="document in this.allowed_additional_documents(specification)">
     <cbc:ID>${document['id']}</cbc:ID>
     <cbc:DocumentTypeCode py:if="document.get('code')">${document['code']}</cbc:DocumentTypeCode>
     <cbc:DocumentDescription py:if="document.get('description')">${document['description']}</cbc:DocumentDescription>