ods: do not consider _ number separator as valid (#48252)

tests/backoffice_pages/test_export.py

@@ -400,6 +400,9 @@ def test_backoffice_ods(pub):
         fields.StringField(
             id='10', label='number with comma field', type='string',
             display_locations=['validation', 'summary', 'listings']),
+        fields.StringField(
+            id='11', label='not a number, with underscore', type='string',
+            display_locations=['validation', 'summary', 'listings']),
     ]
     formdef.workflow_roles = {'_receiver': 1}
     formdef.store()
@@ -421,6 +424,7 @@ def test_backoffice_ods(pub):
         '8': time.strptime('1871-03-18', '%Y-%m-%d'),
         '9': 'plop\npl\x1dop',  # with control characters
         '10': ' 123,45',
+        '11': '1_000_000',
     }
     formdata.data['4'].receive([b'hello world'])
     formdata.just_created()
@@ -449,6 +453,7 @@ def test_backoffice_ods(pub):
     old_column = all_texts.index('very old field')
     string_column = all_texts.index('string field')
     comma_number_column = all_texts.index('number with comma field')
+    not_number_column = all_texts.index('not a number, with underscore')
 
     for row in ods_sheet.findall('.//{%s}table-row' % ods.NS['table']):
         if row.findall('.//{%s}table-cell/{%s}p' % (
@@ -479,6 +484,8 @@ def test_backoffice_ods(pub):
             string_column].find('{%s}p' % ods.NS['text']).text == 'plop\nplop'
     assert row.findall('.//{%s}table-cell' % ods.NS['table'])[comma_number_column].attrib[
             '{%s}value' % ods.NS['office']] == '123.45'
+    assert row.findall('.//{%s}table-cell' % ods.NS['table'])[not_number_column].attrib[
+            '{%s}value-type' % ods.NS['office']] == 'string'
 
 
 @pytest.mark.skipif('xlwt is None')

wcs/qommon/ods.py

@@ -55,8 +55,14 @@ def is_number(value):
         # avoid phone numbers
         return False
     if isinstance(value, str):
+        value = value.strip()
         # replace comma by dot, to handle decimal separator
         value = value.replace(',', '.', 1)
+        if not re.match(r'^\d+(\.\d+)?$', value):
+            # check we have digits and an optional decimal separator.
+            # this avoids _ used as a number separator (ex: 1_000_000) to be
+            # accepted.
+            return False
     try:
         float(value)
     except ValueError: