mass-update, lead capture: use sanitize

application/Espo/Tools/LeadCapture/CaptureService.php

@@ -39,6 +39,7 @@ use Espo\Core\FieldValidation\FieldValidationParams;
 use Espo\Core\HookManager;
 use Espo\Core\Job\QueueName;
 use Espo\Core\ORM\EntityManager;
+use Espo\Core\Record\ServiceContainer;
 use Espo\Core\Utils\DateTime as DateTimeUtil;
 use Espo\Core\Utils\FieldUtil;
 use Espo\Core\Utils\Language;
@@ -67,7 +68,8 @@ class CaptureService
         private FieldValidationManager $fieldValidationManager,
         private JobSchedulerFactory $jobSchedulerFactory,
         private CampaignService $campaignService,
-        private PhoneNumberSanitizer $phoneNumberSanitizer
+        private PhoneNumberSanitizer $phoneNumberSanitizer,
+        private ServiceContainer $serviceContainer
     ) {}
 
     /**
@@ -467,9 +469,10 @@ class CaptureService
             throw new Error('No field list specified.');
         }
 
-        $this->setFields($fieldList, $data, $lead);
+        $this->sanitizePhoneNumber($fieldList, $data, $leadCapture);
+        $this->serviceContainer->getByClass(Lead::class)->sanitizeInput($data);
 
-        $this->sanitizePhoneNumber($fieldList, $data, $lead, $leadCapture);
+        $this->setFields($fieldList, $data, $lead);
 
         if ($leadCapture->getLeadSource()) {
             $lead->set('source', $leadCapture->getLeadSource());
@@ -663,21 +666,18 @@ class CaptureService
     private function sanitizePhoneNumber(
         array $fieldList,
         stdClass $data,
-        Lead $lead,
         LeadCaptureEntity $leadCapture
     ): void {
 
         if (
             !in_array('phoneNumber', $fieldList) ||
             !isset($data->phoneNumber) ||
-            $lead->getPhoneNumber() === null
+            !is_string($data->phoneNumber)
         ) {
             return;
         }
 
-        $value = $this->phoneNumberSanitizer
-            ->sanitize($lead->getPhoneNumber(), $leadCapture->getPhoneNumberCountry());
-
-        $lead->set('phoneNumber', $value);
+        $data->phoneNumber = $this->phoneNumberSanitizer
+            ->sanitize($data->phoneNumber, $leadCapture->getPhoneNumberCountry());
     }
 }

application/Espo/Tools/MassUpdate/Processor.php

@@ -36,21 +36,16 @@ use Espo\Core\FieldProcessing\Loader\Params as LoaderParams;
 use Espo\Core\MassAction\QueryBuilder;
 use Espo\Core\MassAction\Params;
 use Espo\Core\MassAction\Result;
-
 use Espo\Core\Acl;
 use Espo\Core\Acl\Table;
 use Espo\Core\Record\Access\LinkCheck;
 use Espo\Core\Record\ActionHistory\Action as RecordAction;
 use Espo\Core\Record\ServiceFactory;
 use Espo\Core\Record\Service;
-
 use Espo\Core\Utils\FieldUtil;
 use Espo\Core\Exceptions\Forbidden;
-
-use Espo\Entities\ActionHistoryRecord;
 use Espo\ORM\EntityManager;
 use Espo\ORM\Entity;
-
 use Espo\Repositories\Attachment as AttachmentRepository;
 use Espo\Entities\User;
 use Espo\Entities\Attachment;
@@ -137,6 +132,7 @@ class Processor
         $values = $data->getValues();
 
         $service->filterUpdateInput($values);
+        $service->sanitizeInput($values);
 
         foreach ($data->getAttributeList() as $attribute) {
             if (!property_exists($values, $attribute)) {