Fix Telegram sendMessage: switch to HTML parse mode, escape user data

app/main.py

@@ -985,20 +985,23 @@ async def request_access(request: Request, db: Session = Depends(get_db)):
     if not _re.match(r'^[\+\d][\d\s\-\(\)]{6,18}$', phone):
         raise HTTPException(status_code=422, detail="Некорректный номер телефона")
 
+    import html as _html
+    def _e(s): return _html.escape(str(s))
+
     products_text = ""
     if products:
-        items = "\n".join(f"  • {p}" for p in products)
-        products_text = f"\n\n🖥 *Интересующие продукты:*\n{items}"
+        items = "\n".join(f"  • {_e(p)}" for p in products)
+        products_text = f"\n\n🖥 <b>Интересующие продукты:</b>\n{items}"
 
     divider = "━━━━━━━━━━━━━━━━━━━━━━"
-    manager_text = f"\n🤝 *Менеджер MONT:*  {manager}" if manager else ""
+    manager_text = f"\n🤝 <b>Менеджер MONT:</b>  {_e(manager)}" if manager else ""
     text = (
-        f"🔔 *Новый запрос доступа к полигону MONT*\n"
+        f"🔔 <b>Новый запрос доступа к полигону MONT</b>\n"
         f"{divider}\n\n"
-        f"👤 *Имя:*  {name}\n"
-        f"🏢 *Компания:*  {company}\n"
-        f"📧 *Email:*  {email}\n"
-        f"📱 *Телефон:*  {phone}"
+        f"👤 <b>Имя:</b>  {_e(name)}\n"
+        f"🏢 <b>Компания:</b>  {_e(company)}\n"
+        f"📧 <b>Email:</b>  {_e(email)}\n"
+        f"📱 <b>Телефон:</b>  {_e(phone)}"
         f"{manager_text}"
         f"{products_text}"
     )
@@ -1008,8 +1011,8 @@ async def request_access(request: Request, db: Session = Depends(get_db)):
     geo = _get_geo(ip)
     geo_text = ""
     if geo:
-        geo_text += "\n📍 *Местоположение:*  " + geo
-    geo_text += "\n🖥 *IP:*  " + ip
+        geo_text += "\n📍 <b>Местоположение:</b>  " + _e(geo)
+    geo_text += "\n🖥 <b>IP:</b>  " + _e(ip)
     text += geo_text
 
     if not TELEGRAM_BOT_TOKEN or not TELEGRAM_CHAT_ID:
@@ -1037,7 +1040,7 @@ async def request_access(request: Request, db: Session = Depends(get_db)):
         _tg_api("sendMessage", {
             "chat_id": TELEGRAM_CHAT_ID,
             "text": text,
-            "parse_mode": "Markdown",
+            "parse_mode": "HTML",
             "reply_markup": _make_approval_keyboard(req_id),
         })
     except Exception as e: