Please address the comments from this code review:

## Individual Comments

### Comment 1
<location> `src/main/java/ca/openosp/openo/documentManager/actions/ManageDocument2Action.java:1038-1040` </location>
<code_context>
         fileName = newDoc.getFileName();
-        destFilePath = savePath + fileName;
+        // Sanitize the filename to match what the file system will actually create
+        String sanitizedFileName = fileName.replaceAll("[^a-zA-Z0-9._-]", "");
+        newDoc.setFileName(sanitizedFileName);
+        destFilePath = savePath + sanitizedFileName;
         String doc_no = "";

</code_context>

<issue_to_address>
**issue:** Sanitizing fileName may result in empty or invalid filenames.

If sanitization removes all characters, the filename may become empty, leading to file system errors or overwriting. Please add a check to ensure the result is non-empty and unique.
</issue_to_address>

### Comment 2
<location> `src/main/java/ca/openosp/openo/documentManager/actions/ManageDocument2Action.java:1056-1062` </location>
<code_context>
         boolean success = f1.renameTo(new File(destFilePath));
         if (!success) {
             log.error("Not able to move " + f1.getName() + " to " + destFilePath);
-            // File was not successfully moved
+            // File was not successfully moved - return error to prevent orphaned database entries
+            request.setAttribute("errorMessage", "Failed to save document file. Please try again.");
+            return "error";
         } else {

</code_context>

<issue_to_address>
**suggestion (bug_risk):** Returning "error" on file move failure may leave temporary files orphaned.

Add logic to delete or archive the temporary file if the move fails to avoid leaving orphaned files.

```suggestion
        boolean success = f1.renameTo(new File(destFilePath));
        if (!success) {
            log.error("Not able to move " + f1.getName() + " to " + destFilePath);
            // File was not successfully moved - attempt to delete temp file to prevent orphaned files
            boolean deleted = f1.delete();
            if (!deleted) {
                log.warn("Failed to delete temporary file: " + f1.getAbsolutePath());
            }
            request.setAttribute("errorMessage", "Failed to save document file. Please try again.");
            return "error";
        } else {
```
</issue_to_address>

### Comment 3
<location> `src/main/java/ca/openosp/openo/documentManager/actions/AddEditDocument2Action.java:250-253` </location>
<code_context>
             }
-            // original file name
-            String fileName1 = this.docFileFileName;
+            // sanitize the original file name first
+            String fileName1 = MiscUtils.sanitizeFileName(this.docFileFileName);

             EDoc newDoc = new EDoc(this.getDocDesc(), this.getDocType(), fileName1, "", this.getDocCreator(), this.getResponsibleId(), this.getSource(), 'A', this.getObservationDate(), "", "", this.getFunction(), this.getFunctionId());
</code_context>

<issue_to_address>
**suggestion (bug_risk):** Sanitizing the original file name may not guarantee uniqueness.

Appending a timestamp, UUID, or similar unique identifier to the sanitized file name will help prevent collisions when files with similar names are uploaded.

```suggestion
            // sanitize the original file name first
            String sanitizedFileName = MiscUtils.sanitizeFileName(this.docFileFileName);

            // append a unique identifier to the sanitized file name to prevent collisions
            String uniqueId = java.util.UUID.randomUUID().toString();
            String fileExtension = "";
            int extIndex = sanitizedFileName.lastIndexOf(".");
            if (extIndex > 0 && extIndex < sanitizedFileName.length() - 1) {
                fileExtension = sanitizedFileName.substring(extIndex);
                sanitizedFileName = sanitizedFileName.substring(0, extIndex);
            }
            String fileName1 = sanitizedFileName + "_" + uniqueId + fileExtension;

            EDoc newDoc = new EDoc(this.getDocDesc(), this.getDocType(), fileName1, "", this.getDocCreator(), this.getResponsibleId(), this.getSource(), 'A', this.getObservationDate(), "", "", this.getFunction(), this.getFunctionId());
```
</issue_to_address>

### Comment 4
<location> `src/main/java/ca/openosp/openo/documentManager/actions/AddEditDocument2Action.java:393` </location>
<code_context>
                 File docFile = this.getDocFile();
                 if (docFile != null && docFile.exists()) {
-                    fileName = this.docFileFileName;
+                    fileName = MiscUtils.sanitizeFileName(this.docFileFileName);
                     updateFileContent = true; // set update to true
                 }
</code_context>

<issue_to_address>
**suggestion:** Sanitization during editDocument may not match original naming conventions.

Verify that the file name sanitization here matches the approach used during document creation to prevent inconsistencies.

Suggested implementation:

```java
                    fileName = DocumentUtils.getSanitizedFileName(this.docFileFileName);

```

- If `DocumentUtils.getSanitizedFileName` is not the actual method used during document creation, replace it with the correct one.
- If the document creation logic uses a different utility or static method, ensure you import and use that method here.
- If the sanitization logic is inline or custom, refactor it into a reusable method and use it in both places.
</issue_to_address>

### Comment 5
<location> `src/main/webapp/documentManager/error.jsp:20-3` </location>
<code_context>
+            <h3><span class="glyphicon glyphicon-exclamation-sign"></span> Document Error</h3>
+            <p>
+                <%
+                String errorMessage = (String) request.getAttribute("errorMessage");
+                if (errorMessage != null) {
+                    out.print(errorMessage);
+                } else {
+                    out.print("An error occurred while processing the document. The document may not exist or there was a problem with the file upload.");
+                }
+                %>
+            </p>
+
</code_context>

<issue_to_address>
**🚨 issue (security):** Error message display may expose internal details to end users.

Review errorMessage content to prevent exposure of sensitive system information to users.
</issue_to_address>