Improved input sanitizing with thousand separators

For languages with non-breaking space as thousand separator,
standard space input should also be allowed, as few people know
how to enter non-breaking space on keyboards. Refs #17217.
Thanks Alexey Boriskin for the report and initial patch.

1 files changed, 13 insertions, 11 deletions

diff --git a/django/utils/formats.py b/django/utils/formats.py
index 03b9918edf..f0abdc2f7b 100644
--- a/django/utils/formats.py
+++ b/django/utils/formats.py
@@ -1,5 +1,6 @@
 import decimal
 import datetime
+import unicodedata
 
 from django.conf import settings
 from django.utils import dateformat, numberformat, datetime_safe
@@ -192,16 +193,17 @@ def sanitize_separators(value):
     Sanitizes a value according to the current decimal and
     thousand separator setting. Used with form field input.
     """
-    if settings.USE_L10N:
+    if settings.USE_L10N and isinstance(value, six.string_types):
+        parts = []
         decimal_separator = get_format('DECIMAL_SEPARATOR')
-        if isinstance(value, six.string_types):
-            parts = []
-            if decimal_separator in value:
-                value, decimals = value.split(decimal_separator, 1)
-                parts.append(decimals)
-            if settings.USE_THOUSAND_SEPARATOR:
-                parts.append(value.replace(get_format('THOUSAND_SEPARATOR'), ''))
-            else:
-                parts.append(value)
-            value = '.'.join(reversed(parts))
+        if decimal_separator in value:
+            value, decimals = value.split(decimal_separator, 1)
+            parts.append(decimals)
+        if settings.USE_THOUSAND_SEPARATOR:
+            thousand_sep = get_format('THOUSAND_SEPARATOR')
+            for replacement in set([
+                    thousand_sep, unicodedata.normalize('NFKD', thousand_sep)]):
+                value = value.replace(replacement, '')
+        parts.append(value)
+        value = '.'.join(reversed(parts))
     return value