Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.
I have tried searching http://www.drupalcommerce.org/contrib. It's challenging to click through 10s of pages. Is it possible you add a "search field" or a "display all"? :)
That code will work for the product select list shown in conjunction with product attributes. You'll need a different variable for a standalone product list, $form['product_id'].
These are the code comments for the select list the code above alters:
// Note that this element by default is a select list, so its #options
// are not sanitized here. Sanitization will occur in a check_plain() in
// the function form_select_options(). If you alter this element to
// another #type, such as 'radios', you are also responsible for looping
// over its #options array and sanitizing the values.
Thank you for your feedback Ryan! Here's the updated code where options are sanitized:
<?php
function MYMODULE_form_alter(&$form, $form_state, $form_id) {
if (strpos($form_id, 'commerce_cart_add_to_cart_form_') === 0 && isset($form['product_id'])) {
// Sanitization of select options will occur in a check_plain() in
// the function form_select_options(). We change this element to
// another #type, 'radios', and hence we are also responsible for looping
// over its #options array and sanitizing the values.
foreach ($form['product_id']['#options'] as $key => $value) {
$form['product_id']['#options'][$key] = check_plain($value);
}
// Change element to #type radios.
$form['product_id']['#type'] = "radios";
}
}
?>
@jessicakoh: Sanitize = convert to plain text -> remove html / js. Without this, html / js included in product titles will render in product options, posing a security threat.
Comments
Comment #1
rszrama commentedYou'd have to alter the Add to Cart form in a custom module; there's no place to do this in the UI.
Comment #2
jessicakoh commentedIs there an existing module for this already?
Does this guy's code look OK? http://drupal.org/node/1343192 If yes, I should try to make my own module.
I have tried searching http://www.drupalcommerce.org/contrib. It's challenging to click through 10s of pages. Is it possible you add a "search field" or a "display all"? :)
Comment #3
rszrama commentedThat code will work for the product select list shown in conjunction with product attributes. You'll need a different variable for a standalone product list,
$form['product_id'].Comment #5
konordo commentedComment #6
rszrama commentedJust remember to sanitize the #options values when you change it to radios.
Comment #7
jessicakoh commentedWhat do you mean by "sanitize"? :)
initialize the variable?
Comment #8
rszrama commentedNope, iterating over the #options array and passing the values through check_plain() to ensure HTML / JS is escaped properly.
Comment #9
facine commentedI am developing a module that you may be interested.
http://drupal.org/sandbox/facine/1687512
a greeting
Comment #10
rszrama commentedThese are the code comments for the select list the code above alters:
Comment #11
jessicakoh commentedWill take a look and try it out. Thank you. I love open source. Everyone can chip in.
Comment #12
konordo commentedThank you for your feedback Ryan! Here's the updated code where options are sanitized:
@jessicakoh: Sanitize = convert to plain text -> remove html / js. Without this, html / js included in product titles will render in product options, posing a security threat.