Validate subject doesn’t contain file placeholders

Author: quis

app/main/forms.py

@@ -16,6 +16,7 @@
 from markupsafe import Markup
 from notifications_utils.countries.data import Postage
 from notifications_utils.eventlet import SoftEventletTimeout
+from notifications_utils.field import Field as UtilsField
 from notifications_utils.formatters import strip_all_whitespace
 from notifications_utils.insensitive_dict import InsensitiveDict, InsensitiveSet
 from notifications_utils.recipient_validation.email_address import format_email_address, validate_email_address
@@ -1479,6 +1480,10 @@ def validate_address(self, field):
 
 
 class EmailTemplateForm(BaseTemplateForm, TemplateNameMixin):
+    def __init__(self, *args, email_file_filenames=None, **kwargs):
+        super().__init__()
+        self.email_file_filenames = email_file_filenames or set()
+
     subject = GovukTextareaField("Subject", validators=[NotifyDataRequired(thing="the subject of the email")])
     has_unsubscribe_link = GovukCheckboxField(
         "Add an unsubscribe link",
@@ -1492,6 +1497,10 @@ class EmailTemplateForm(BaseTemplateForm, TemplateNameMixin):
         },
     )
 
+    def validate_subject(self, field):
+        if InsensitiveSet(UtilsField(field.data).placeholders).intersection(self.email_file_filenames):
+            raise ValidationError("You can put a file in the subject")
+
 
 class LetterTemplateForm(BaseTemplateForm, TemplateNameMixin):
     subject = GovukTextareaField("Heading", validators=[NotifyDataRequired(thing="a main heading for your letter")])

app/main/views/templates.py

@@ -78,9 +78,13 @@
 from app.utils.user import user_has_permissions
 
 
-def get_template_form(template_type: Literal["email", "sms", "letter"], language: Literal["welsh"] | None = None):
+def get_template_form(
+    template_type: Literal["email", "sms", "letter"],
+    email_file_filenames=None,
+    language: Literal["welsh"] | None = None,
+):
     if template_type == "email":
-        return EmailTemplateForm
+        return partial(EmailTemplateForm, email_file_filenames=email_file_filenames)
     elif template_type == "sms":
         return SMSTemplateForm
     else:
@@ -734,7 +738,11 @@ def edit_service_template(service_id, template_id, language=None):  # noqa
 
     abort_for_unauthorised_bilingual_letters_or_invalid_options(language, template)
 
-    form = get_template_form(template.template_type, language=language)(**template._template)
+    form = get_template_form(
+        template.template_type,
+        email_file_filenames=getattr(template, "filenames", None),
+        language=language,
+    )(**template._template)
 
     if form.validate_on_submit():
         new_template = get_template(