From 7a17c43b262bfcf565fea6922b33d574020ebe4e Mon Sep 17 00:00:00 2001
From: atm-josselin <josselin.arpin@atm-consulting.fr>
Date: Mon, 24 Jun 2019 16:05:24 +0200
Subject: [PATCH 1/2] FIX : filepath of generated documents doesn't handle
 products with special characters

---
 htdocs/core/class/html.formfile.class.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/htdocs/core/class/html.formfile.class.php b/htdocs/core/class/html.formfile.class.php
index 679989a75a0..522804b601c 100644
--- a/htdocs/core/class/html.formfile.class.php
+++ b/htdocs/core/class/html.formfile.class.php
@@ -764,7 +764,7 @@ class FormFile
 
 					// Show file name with link to download
 					$out.= '<td class="minwidth200">';
-					$out.= '<a class="documentdownload paddingright" href="'.$documenturl.'?modulepart='.$modulepart.'&amp;file='.urlencode($relativepath).($param?'&'.$param:'').'"';
+					$out.= '<a class="documentdownload paddingright" href="'.$documenturl.'?modulepart='.$modulepart.'&amp;file='.urlencode(dol_sanitizePathName($relativepath)).($param?'&'.$param:'').'"';
 					$mime=dol_mimetype($relativepath,'',0);
 					if (preg_match('/text/',$mime)) $out.= ' target="_blank"';
 					$out.= '>';

From c24a95b7ad11322eede188e630ac8b38e1ca631c Mon Sep 17 00:00:00 2001
From: atm-josselin <josselin.arpin@atm-consulting.fr>
Date: Mon, 1 Jul 2019 09:31:01 +0200
Subject: [PATCH 2/2] Sanitize at creation of the product instead of the
 creation of the filepath

---
 htdocs/core/class/html.formfile.class.php | 2 +-
 htdocs/product/class/product.class.php    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/htdocs/core/class/html.formfile.class.php b/htdocs/core/class/html.formfile.class.php
index 522804b601c..679989a75a0 100644
--- a/htdocs/core/class/html.formfile.class.php
+++ b/htdocs/core/class/html.formfile.class.php
@@ -764,7 +764,7 @@ class FormFile
 
 					// Show file name with link to download
 					$out.= '<td class="minwidth200">';
-					$out.= '<a class="documentdownload paddingright" href="'.$documenturl.'?modulepart='.$modulepart.'&amp;file='.urlencode(dol_sanitizePathName($relativepath)).($param?'&'.$param:'').'"';
+					$out.= '<a class="documentdownload paddingright" href="'.$documenturl.'?modulepart='.$modulepart.'&amp;file='.urlencode($relativepath).($param?'&'.$param:'').'"';
 					$mime=dol_mimetype($relativepath,'',0);
 					if (preg_match('/text/',$mime)) $out.= ' target="_blank"';
 					$out.= '>';
diff --git a/htdocs/product/class/product.class.php b/htdocs/product/class/product.class.php
index 47e8be9067c..50495d16a90 100644
--- a/htdocs/product/class/product.class.php
+++ b/htdocs/product/class/product.class.php
@@ -429,7 +429,7 @@ class Product extends CommonObject
             $error=0;
 
         // Clean parameters
-        $this->ref = dol_string_nospecial(trim($this->ref));
+        $this->ref = dol_sanitizeFileName(dol_string_nospecial(trim($this->ref)));
         $this->label = trim($this->label);
         $this->price_ttc=price2num($this->price_ttc);
         $this->price=price2num($this->price);