Per #2560455-10: Add a "Shipping service upgrade" offer type, we should be using the component title instead of the label in the extra description added beneath a shipping service to indicated it has been discounted. Note that we also aren't currently escaping the label, but since this module does not have a full release, a security release is not warranted or supported. I believe this is sufficient since discount names would only be set by store administrators anyways.

Increasing the priority for the security fix, not because using the wrong label is itself a major issue.

CommentFileSizeAuthor
#2 2560767-2.shipping_discount_text.patch856 bytesrszrama

Comments

rszrama created an issue. See original summary.

rszrama’s picture

rszrama commented
Status: Active » Needs review
StatusFileSize
new 2560767-2.shipping_discount_text.patch856 bytes

Patch attached.

rszrama’s picture

rszrama commented
Status: Needs review » Fixed

Committing this as it's a non-intrusive, security patch.

  • rszrama committed 9c3784f on 7.x-1.x 
    Issue #2560767 by rszrama: use the component title instead of admin...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.