If the field items array is empty, then the formatter code below will load all products with status=1.... a warning to anyone using commerce_product_load_multiple() with a filter array.

commerce_product_reference_field_formatter_view():

392  // Collect the list of product IDs.
393  $product_ids = array();
394
395  foreach ($items as $delta => $item) {
396    $product_ids[$item['product_id']] = $item['product_id'];
397  }
398
399  $products = commerce_product_load_multiple($product_ids, array('status' => 1));
CommentFileSizeAuthor
#1 empty-pref-ids-check-1345214-1.patch662 bytesrecrit

Comments

recrit’s picture

Status: Active » Needs review
StatusFileSize
new662 bytes

patch attached adds an empty check after the field items loop.

rszrama’s picture

Status: Needs review » Fixed

Nice find! Committing.

For the security conscious - there is no accidental display happening, as even though we load all products (which is a performance drag I'm sure), we still only display products actually included in the $items array... namely, none of them.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.