From aec4eae3f5a7bc0f2275572bd173d6320efb97f2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=A9dric=20Krier?= Date: Sat, 19 Oct 2024 16:34:36 +0200 Subject: [PATCH] Replace forbidden char of document incoming name by space When creating document incoming from email, the name value must be sanitized as there is no control on the data. Closes #13608 --- modules/document_incoming/document.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/modules/document_incoming/document.py b/modules/document_incoming/document.py index 4525707717..5099485b01 100644 --- a/modules/document_incoming/document.py +++ b/modules/document_incoming/document.py @@ -186,9 +186,12 @@ class Incoming(DeactivableMixin, Workflow, ModelSQL, ModelView): data = message.get('text', message.get('html')) if isinstance(data, str): data = data.encode() + name = message.get('subject') or 'No Subject' + for forbidden_char in cls.name.forbidden_chars: + name = name.replace(forbidden_char, ' ') document = cls( active=active, - name=message.get('subject') or 'No Subject', + name=name, company=rule.document_incoming_company, data=data, type=rule.document_incoming_type if active else None,