Replace forbidden char of document incoming name by space

When creating document incoming from email, the name value must be sanitized as
there is no control on the data.

Closes #13608

modules/document_incoming/document.py

@@ -186,9 +186,12 @@ class Incoming(DeactivableMixin, Workflow, ModelSQL, ModelView):
         data = message.get('text', message.get('html'))
         if isinstance(data, str):
             data = data.encode()
+        name = message.get('subject') or 'No Subject'
+        for forbidden_char in cls.name.forbidden_chars:
+            name = name.replace(forbidden_char, ' ')
         document = cls(
             active=active,
-            name=message.get('subject') or 'No Subject',
+            name=name,
             company=rule.document_incoming_company,
             data=data,
             type=rule.document_incoming_type if active else None,