Products are not added to cart

[AndreeaCristinaRadacina]

Description

Many users reported that after the latest update, the products are not added to cart anymore. There is no error triggered, but the cart is empty.

I couldn't replicate the issue.

Step-by-step reproduction instructions

1. Go to a PPOM product with text input
2. Configure the product options
3. Click on add to cart button

Screenshots, screen recording, code snippet or Help Scout ticket

example from a client: https://280.150.myftpupload.com/product/urc-tkp-100-custom-engraved-button-cap/

ref: https://wordpress.org/support/topic/update-to-32-0-1-breaks-add-to-cart/#post-17773318

Environment info

No response

Is the issue you are reporting a regression

Yes, this is a regression.

[AndreeaCristinaRadacina]

+1 https://secure.helpscout.net/conversation/2601627843/419287?viewId=212385

[AndreeaCristinaRadacina]

+1 https://secure.helpscout.net/conversation/2601200783/419241?viewId=212390

[AndreeaCristinaRadacina]

+1 https://secure.helpscout.net/conversation/2604221842/419682?viewId=212390

[AndreeaCristinaRadacina]

+1 https://secure.helpscout.net/conversation/2603159555/419477?viewId=212390

[AndreeaCristinaRadacina]

+1 https://wordpress.org/support/topic/update-to-32-0-1-breaks-add-to-cart/

[vytisbulkevicius]

@AndreeaCristinaRadacina,

This happens because we had to patch vulnerability which was allowing to add HTML characters to the input fields.

We no longer allow adding HTML characters so this can't be replicated by new users or when creating new fields but those existing fields that had HTML characters should be re-saved by users.

We need to ask those users to go to the fields that have HTML values added and re-save the fields so HTML values get trimmed.
This should be done for the input fields values or select fields values, basically the fields that send user input to the backend, for labels and description of fields they can use it with no problem.

Example from one of the websites with this problem where HTML is still saved in the value of the field:

[AndreeaCristinaRadacina]

@vytisbulkevicius Now I was able to replicate the issue too. When adding <p>hello</p> in the text input, the product is not added to the cart.

To ensure I understood this correctly, can you please validate the reply below?

`After the latest release, PPOM no longer permits the use of HTML characters in new fields or by new users. However, any existing fields that contain HTML characters will need to be re-saved to ensure correct functioning.

Please go to the fields that contain HTML values and re-save them to ensure the HTML values are trimmed. This applies to input fields and select fields where user input is sent to the backend. HTML characters can still be used without any issues for labels and field descriptions.

Thank you for your cooperation.`

[vytisbulkevicius]

@AndreeaCristinaRadacina,

Yes, it's correct. I would change a few places in your reply to prevent confusion:

After the latest release, PPOM no longer permits the use of HTML characters in the input and select fields. However, any existing fields that contain HTML characters will need to be re-saved to ensure correct functioning since they were not trimmed by the plugin update.

Please go to edit the fields that contain HTML values and re-save them to ensure the HTML values are trimmed on save. This only applies to input fields and select fields where HTML characters are used for value. HTML characters can still be used without any issues for labels and field descriptions.

Thank you for your cooperation.

[AndreeaCristinaRadacina]

Hey Vytis,

The customers say it doesn't work after updating all the fields:
https://secure.helpscout.net/conversation/2601200783/419241?viewId=212385
https://secure.helpscout.net/conversation/2601627843/419287?viewId=212385
https://secure.helpscout.net/conversation/2613097062/420708?viewId=212385
https://secure.helpscout.net/conversation/2603159555/419477?viewId=212385

[AndreeaCristinaRadacina]

+1 https://secure.helpscout.net/conversation/2625501215/422156?viewId=212385

[Soare-Robert-Daniel]

We might need to reconsider how we deal with HTML content in the fields since it seems that there are a lot of users who have HTML in their fields.

Instead of hard rejecting the request, I think we can switch to sanitization ( like using sanitize_textarea_field ) to clean up any potential issue.

CC: @preda-bogdan

[AndreeaCristinaRadacina]

+1 https://secure.helpscout.net/conversation/2630775873/422889?viewId=212385

[AndreeaCristinaRadacina]

@Soare-Robert-Daniel I tested and now it works. Thank you for taking care!

[AndreeaCristinaRadacina]

https://secure.helpscout.net/conversation/2634654179/423325?viewId=212385

[vytisbulkevicius]

It's fixed and released @AndreeaCristinaRadacina