I am getting several orders with Credit card payment declined: SGS-020003: Invalid XML. When I look into these orders they all have a product with a text field attribute on them that has a < symbol in it. Orders without the symbol process fine. I know that there is already a function to remove ampersands and single quotes from the xml, this seems like a simple oversight.

Comments

bkosborne’s picture

bkosborne
Primary language English
Location New Jersey, USA
commented

Thanks for bringing this up... I will add to the cleansing function

bkosborne’s picture

bkosborne
Primary language English
Location New Jersey, USA
commented
Status: Active » Fixed

This has been fixed in Git.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

jrust’s picture

jrust commented
Status: Closed (fixed) » Active

This actually breaks everything by escaping all < and >.

jrust’s picture

jrust commented
Status: Active » Fixed

Only escaping the notes field now which is the only place that should have user-input characters that could break the xml.

bkosborne’s picture

bkosborne
Primary language English
Location New Jersey, USA
commented

Wow... can't believe I did that one lol... Thanks

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.