As observed by haysuess over at http://www.ubercart.org/forum/support/7265/ampersand_and_product_attributes , check_plain gets called twice on the attributes displayed for products on the checkout page. While this normally would not cause a problem it will convert something like an ampersand into & in the first check_plain and then & in the second check_plain which results in a final output of &

Comments

cyu’s picture

cyu commented

My original description got sanitized, but what I meant was that...

& is converted to & and then to & which ends up showing as &
Island Usurper’s picture

Island Usurper commented
Status: Active » Fixed

The checkout page wasn't using hook_cart_display() to list the products, so it was using t() to run check_plain() on the option value. hook_cart_display() wasn't doing this presumably because uc_cart_get_product_options() was already sanitizing that value.

I've fixed it by removing the check_plain() from uc_cart_get_product_options(), and adding t() to uc_product_cart_display(), so that the output is filtered at the same layer.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for two weeks with no activity.