Product reference fields doesn't actually validate user input, but instead strip anything that cannot be found.

This is very poor behavior for two reasons.

1. It's possible to bypass a required product reference field, by entering a random string (bug).
2. By not giving the user any feedback that he/she entered an invalid value the user can thing, that what he entered was ok. since it can be quite hard to see the values when there are multiple values entered, this is very bad UX.

I think the best option would be to require all values entered to actually be valid.

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

googletorp’s picture

Status: Active » Needs review
FileSize
680 bytes

And the patch that fixes this by doing the validation.

rszrama’s picture

Status: Needs review » Fixed

Easy enough; tweaked the message and committed.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.